{"id":"CVE-2026-54516","aliases":["CLSA-2026-1793538772","CLSA-2026-1793867220","CLSA-2026-1793870147","CLSA-2026-1793870277","CLSA-2026-1793870643","CLSA-2026-1793871098","CLSA-2026-1793871562","CLSA-2026-1793871976","CLSA-2026-1793872286","CLSA-2026-1793872559","CLSA-2026-1793873664","CLSA-2026-1793874032","CLSA-2026-1793874263","CLSA-2026-1793957665","CLSA-2026-1793957775","CLSA-2026-1793958230","CLSA-2026-1793958328","CLSA-2026-1794221927","CLSA-2026-1794222244","CLSA-2026-1794222386","CLSA-2026-1794223842","CLSA-2026-1794223928","CLSA-2026-1794223990","CLSA-2026-1794224575","CLSA-2026-1794224690","CLSA-2026-1794225259","CLSA-2026-1794225369","CLSA-2026-1794225420","CLSA-2026-1794225652","CLSA-2026-1794226057","CLSA-2026-1794226147","CLSA-2026-1794226255","CLSA-2026-1794226417","CLSA-2026-1794226556","CLSA-2026-1794226743","CLSA-2026-1794227115","CLSA-2026-1794227208","CLSA-2026-1794227319","CLSA-2026-1794228139","CLSA-2026-1794229294","CLSA-2026-1794229539","CLSA-2026-1794229558","CLSA-2026-1794229591","CLSA-2026-1794229674","CLSA-2026-1794229690","CLSA-2026-1794229701","CLSA-2026-1794229773","CLSA-2026-1794230031","CLSA-2026-1794231173","CLSA-2026-1794231276","CLSA-2026-1794231765","CLSA-2026-1794232296","CLSA-2026-1794232320","CLSA-2026-1794232556","CLSA-2026-1794232670","CLSA-2026-1794232730","CLSA-2026-1794232790","CLSA-2026-1794233060","DEBIAN-CVE-2026-54516","EUVD-2026-38590","GHSA-9fxm-vc8v-hj55","ROOT-APP-MAVEN-CVE-2026-54516","UBUNTU-CVE-2026-54516"],"status":"published","title":"jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00449,"percentile":0.39292,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-915"],"published":"2026-06-23T20:48:52Z","modified":"2026-11-09T19:15:14Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.21.4","3.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.2-tuxcare.2"],"sources":["osv"]},{"ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.17.0-tuxcare.3","2.15.2-tuxcare.5","2.15.4-tuxcare.5","2.16.0-tuxcare.5","2.16.1-tuxcare.4","2.17.2-tuxcare.4","2.17.3-tuxcare.5","2.7.3-tuxcare.5","2.1.4-tuxcare.3","2.9.10.7-tuxcare.5","2.10.5.1-tuxcare.5","2.9.10.4-tuxcare.6","2.9.10.3-tuxcare.7","2.9.10.5-tuxcare.3","2.9.10.6-tuxcare.4","2.9.10.8-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.21.1-aikido.2","2.21.2-aikido.3","3.1.1-aikido.2","2.21.1-aikido.3","2.21.1-aikido.4","2.21.2-aikido.4","2.21.2-aikido.5","2.21.4-aikido.1","2.21.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.0-aikido.2","3.1.1-aikido.3","3.1.0-aikido.3","3.1.1-aikido.4","3.1.0-aikido.4","3.1.0-aikido.5","3.1.1-aikido.5","3.1.4-aikido.2","3.1.4-aikido.3","3.1.4-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.21.1-root.io.2","2.21.2-root.io.3","3.1.1-root.io.2","2.21.1-root.io.3","2.21.1-root.io.4","2.21.2-root.io.4","2.21.2-root.io.5","2.21.4-root.io.1","2.21.4-root.io.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","fixed_in":["3.1.0-root.io.2","3.1.1-root.io.3","3.1.0-root.io.3","3.1.1-root.io.4","3.1.0-root.io.4","3.1.0-root.io.5","3.1.1-root.io.5","3.1.4-root.io.2","3.1.4-root.io.3","3.1.4-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.21.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2"},{"fixed":"3.1.2-tuxcare.2"}]}],"versions":["3.1.2","3.1.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.1"},{"fixed":"2.11.1-tuxcare.5"}]}],"versions":["2.11.1","2.11.1-tuxcare.1","2.11.1-tuxcare.2","2.11.1-tuxcare.3","2.11.1-tuxcare.4"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.3"},{"fixed":"2.15.3-tuxcare.5"}]}],"versions":["2.15.3","2.15.3-tuxcare.1","2.15.3-tuxcare.2","2.15.3-tuxcare.3","2.15.3-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.4"},{"fixed":"2.11.4-tuxcare.4"}]}],"versions":["2.11.4","2.11.4-tuxcare.1","2.11.4-tuxcare.2","2.11.4-tuxcare.3"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.3"},{"fixed":"2.11.3-tuxcare.5"}]}],"versions":["2.11.3","2.11.3-tuxcare.1","2.11.3-tuxcare.2","2.11.3-tuxcare.3","2.11.3-tuxcare.4"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.2"},{"fixed":"2.11.2-tuxcare.3"}]}],"versions":["2.11.2","2.11.2-tuxcare.1","2.11.2-tuxcare.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.0-tuxcare.3"}]}],"versions":["2.17.0","2.17.0-tuxcare.1","2.17.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.2"},{"fixed":"2.15.2-tuxcare.5"}]}],"versions":["2.15.2","2.15.2-tuxcare.1","2.15.2-tuxcare.2","2.15.2-tuxcare.3","2.15.2-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4"},{"fixed":"2.15.4-tuxcare.5"}]}],"versions":["2.15.4","2.15.4-tuxcare.1","2.15.4-tuxcare.2","2.15.4-tuxcare.3","2.15.4-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"fixed":"2.16.0-tuxcare.5"}]}],"versions":["2.16.0","2.16.0-tuxcare.1","2.16.0-tuxcare.2","2.16.0-tuxcare.3","2.16.0-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"2.16.1-tuxcare.4"}]}],"versions":["2.16.1","2.16.1-tuxcare.1","2.16.1-tuxcare.2","2.16.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.4"}]}],"versions":["2.17.2","2.17.2-tuxcare.1","2.17.2-tuxcare.2","2.17.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.5"}]}],"versions":["2.17.3","2.17.3-tuxcare.1","2.17.3-tuxcare.2","2.17.3-tuxcare.3","2.17.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.6"},{"fixed":"2.6.6-tuxcare.4"}]}],"versions":["2.6.6","2.6.6-tuxcare.1","2.6.6-tuxcare.2","2.6.6-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11"},{"fixed":"2.8.11-tuxcare.6"}]}],"versions":["2.8.11","2.8.11-tuxcare.1","2.8.11-tuxcare.2","2.8.11-tuxcare.3","2.8.11-tuxcare.4","2.8.11-tuxcare.5"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.2"},{"fixed":"2.18.2-tuxcare.4"}]}],"versions":["2.18.2","2.18.2-tuxcare.1","2.18.2-tuxcare.2","2.18.2-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.4"},{"fixed":"2.10.4-tuxcare.4"}]}],"versions":["2.10.4","2.10.4-tuxcare.1","2.10.4-tuxcare.2","2.10.4-tuxcare.3"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.0-tuxcare.4"}]}],"versions":["2.4.0","2.4.0-tuxcare.1","2.4.0-tuxcare.2","2.4.0-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1"},{"fixed":"2.4.1-tuxcare.4"}]}],"versions":["2.4.1","2.4.1-tuxcare.1","2.4.1-tuxcare.2","2.4.1-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.4"},{"fixed":"2.8.11.4-tuxcare.5"}]}],"versions":["2.8.11.4","2.8.11.4-tuxcare.1","2.8.11.4-tuxcare.2","2.8.11.4-tuxcare.3","2.8.11.4-tuxcare.4"],"bundled":13},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.3"},{"fixed":"2.9.3-tuxcare.7"}]}],"versions":["2.9.3","2.9.3-tuxcare.1","2.9.3-tuxcare.2","2.9.3-tuxcare.3","2.9.3-tuxcare.4","2.9.3-tuxcare.5","2.9.3-tuxcare.6"],"bundled":20},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.5"},{"fixed":"2.9.5-tuxcare.5"}]}],"versions":["2.9.5","2.9.5-tuxcare.1","2.9.5-tuxcare.2","2.9.5-tuxcare.3","2.9.5-tuxcare.4"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.11.3"},{"fixed":"2.8.11.3-tuxcare.5"}]}],"versions":["2.8.11.3","2.8.11.3-tuxcare.1","2.8.11.3-tuxcare.2","2.8.11.3-tuxcare.3","2.8.11.3-tuxcare.4"],"bundled":14},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9"},{"fixed":"2.9.9-tuxcare.4"}]}],"versions":["2.9.9","2.9.9-tuxcare.1","2.9.9-tuxcare.2","2.9.9-tuxcare.3"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.4"},{"fixed":"2.8.4-tuxcare.7"}]}],"versions":["2.8.4","2.8.4-tuxcare.1","2.8.4-tuxcare.2","2.8.4-tuxcare.3","2.8.4-tuxcare.4","2.8.4-tuxcare.5","2.8.4-tuxcare.6"],"bundled":15},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.1"},{"fixed":"2.9.1-tuxcare.4"}]}],"versions":["2.9.1","2.9.1-tuxcare.1","2.9.1-tuxcare.2","2.9.1-tuxcare.3"],"bundled":19},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.7"},{"fixed":"2.9.7-tuxcare.5"}]}],"versions":["2.9.7","2.9.7-tuxcare.1","2.9.7-tuxcare.2","2.9.7-tuxcare.3","2.9.7-tuxcare.4"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.9.1"},{"fixed":"2.9.9.1-tuxcare.6"}]}],"versions":["2.9.9.1","2.9.9.1-tuxcare.1","2.9.9.1-tuxcare.2","2.9.9.1-tuxcare.3","2.9.9.1-tuxcare.4","2.9.9.1-tuxcare.5"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.4"},{"fixed":"2.9.4-tuxcare.6"}]}],"versions":["2.9.4","2.9.4-tuxcare.1","2.9.4-tuxcare.2","2.9.4-tuxcare.3","2.9.4-tuxcare.4","2.9.4-tuxcare.5"],"bundled":18},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9"},{"fixed":"2.7.9-tuxcare.6"}]}],"versions":["2.7.9","2.7.9-tuxcare.1","2.7.9-tuxcare.2","2.7.9-tuxcare.3","2.7.9-tuxcare.4","2.7.9-tuxcare.5"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.5"},{"fixed":"2.7.5-tuxcare.7"}]}],"versions":["2.7.5","2.7.5-tuxcare.1","2.7.5-tuxcare.2","2.7.5-tuxcare.3","2.7.5-tuxcare.4","2.7.5-tuxcare.5","2.7.5-tuxcare.6"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.1.1"},{"fixed":"2.4.1.1-tuxcare.4"}]}],"versions":["2.4.1.1","2.4.1.1-tuxcare.1","2.4.1.1-tuxcare.2","2.4.1.1-tuxcare.3"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.2"},{"fixed":"2.6.7.2-tuxcare.4"}]}],"versions":["2.6.7.2","2.6.7.2-tuxcare.1","2.6.7.2-tuxcare.2","2.6.7.2-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.5"},{"fixed":"2.6.5-tuxcare.4"}]}],"versions":["2.6.5","2.6.5-tuxcare.1","2.6.5-tuxcare.2","2.6.5-tuxcare.3"],"bundled":9},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.2"},{"fixed":"2.10.2-tuxcare.5"}]}],"versions":["2.10.2","2.10.2-tuxcare.1","2.10.2-tuxcare.2","2.10.2-tuxcare.3","2.10.2-tuxcare.4"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.4"},{"fixed":"2.5.4-tuxcare.5"}]}],"versions":["2.5.4","2.5.4-tuxcare.1","2.5.4-tuxcare.2","2.5.4-tuxcare.3","2.5.4-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.3"},{"fixed":"2.7.3-tuxcare.5"}]}],"versions":["2.7.3","2.7.3-tuxcare.1","2.7.3-tuxcare.2","2.7.3-tuxcare.3","2.7.3-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.4"},{"fixed":"2.1.4-tuxcare.3"}]}],"versions":["2.1.4","2.1.4-tuxcare.1","2.1.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.10"},{"fixed":"2.8.10-tuxcare.7"}]}],"versions":["2.8.10","2.8.10-tuxcare.1","2.8.10-tuxcare.2","2.8.10-tuxcare.3","2.8.10-tuxcare.4","2.8.10-tuxcare.5","2.8.10-tuxcare.6"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.3"},{"fixed":"2.7.9.3-tuxcare.5"}]}],"versions":["2.7.9.3","2.7.9.3-tuxcare.1","2.7.9.3-tuxcare.2","2.7.9.3-tuxcare.3","2.7.9.3-tuxcare.4"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.7"},{"fixed":"2.9.10.7-tuxcare.5"}]}],"versions":["2.9.10.7","2.9.10.7-tuxcare.1","2.9.10.7-tuxcare.2","2.9.10.7-tuxcare.3","2.9.10.7-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.4"},{"fixed":"2.6.4-tuxcare.3"}]}],"versions":["2.6.4","2.6.4-tuxcare.1","2.6.4-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.3"},{"fixed":"2.2.3-tuxcare.4"}]}],"versions":["2.2.3","2.2.3-tuxcare.1","2.2.3-tuxcare.2","2.2.3-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.5.1"},{"fixed":"2.10.5.1-tuxcare.5"}]}],"versions":["2.10.5.1","2.10.5.1-tuxcare.1","2.10.5.1-tuxcare.2","2.10.5.1-tuxcare.3","2.10.5.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.0-tuxcare.5"}]}],"versions":["2.7.0","2.7.0-tuxcare.1","2.7.0-tuxcare.2","2.7.0-tuxcare.3","2.7.0-tuxcare.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.3"},{"fixed":"2.6.3-tuxcare.5"}]}],"versions":["2.6.3","2.6.3-tuxcare.1","2.6.3-tuxcare.2","2.6.3-tuxcare.3","2.6.3-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.4"},{"fixed":"2.9.10.4-tuxcare.6"}]}],"versions":["2.9.10.4","2.9.10.4-tuxcare.1","2.9.10.4-tuxcare.2","2.9.10.4-tuxcare.3","2.9.10.4-tuxcare.4","2.9.10.4-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.3"},{"fixed":"2.9.10.3-tuxcare.7"}]}],"versions":["2.9.10.3","2.9.10.3-tuxcare.1","2.9.10.3-tuxcare.2","2.9.10.3-tuxcare.3","2.9.10.3-tuxcare.4","2.9.10.3-tuxcare.5","2.9.10.3-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.0-tuxcare.5"}]}],"versions":["2.11.0","2.11.0-tuxcare.1","2.11.0-tuxcare.2","2.11.0-tuxcare.3","2.11.0-tuxcare.4"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.3"},{"fixed":"2.4.3-tuxcare.5"}]}],"versions":["2.4.3","2.4.3-tuxcare.1","2.4.3-tuxcare.2","2.4.3-tuxcare.3","2.4.3-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.5"},{"fixed":"2.9.10.5-tuxcare.3"}]}],"versions":["2.9.10.5","2.9.10.5-tuxcare.1","2.9.10.5-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.6"},{"fixed":"2.9.10.6-tuxcare.4"}]}],"versions":["2.9.10.6","2.9.10.6-tuxcare.1","2.9.10.6-tuxcare.2","2.9.10.6-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10.8"},{"fixed":"2.9.10.8-tuxcare.5"}]}],"versions":["2.9.10.8","2.9.10.8-tuxcare.1","2.9.10.8-tuxcare.2","2.9.10.8-tuxcare.3","2.9.10.8-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.9.7"},{"fixed":"2.7.9.7-tuxcare.6"}]}],"versions":["2.7.9.7","2.7.9.7-tuxcare.1","2.7.9.7-tuxcare.2","2.7.9.7-tuxcare.3","2.7.9.7-tuxcare.4","2.7.9.7-tuxcare.5"],"bundled":10},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.7.3"},{"fixed":"2.6.7.3-tuxcare.5"}]}],"versions":["2.6.7.3","2.6.7.3-tuxcare.1","2.6.7.3-tuxcare.2","2.6.7.3-tuxcare.3","2.6.7.3-tuxcare.4"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.10"},{"fixed":"2.9.10-tuxcare.6"}]}],"versions":["2.9.10","2.9.10-tuxcare.1","2.9.10-tuxcare.2","2.9.10-tuxcare.3","2.9.10-tuxcare.4","2.9.10-tuxcare.5"],"bundled":12},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.5"},{"fixed":"2.4.5-tuxcare.5"}]}],"versions":["2.4.5","2.4.5-tuxcare.1","2.4.5-tuxcare.2","2.4.5-tuxcare.3","2.4.5-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.2"},{"fixed":"2.9.2-tuxcare.5"}]}],"versions":["2.9.2","2.9.2-tuxcare.1","2.9.2-tuxcare.2","2.9.2-tuxcare.3","2.9.2-tuxcare.4"],"bundled":23},{"source":"osv","ecosystem":"Debian:13","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1+deb13u1","2.14.0+ds-2","2.14.0+ds-3","2.18.11-1","2.22.4-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-2","2.14.0+ds-3","2.18.11-1","2.22.4-1"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.21.4"}]}],"versions":["2.21.0","2.21.1","2.21.2","2.21.3"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3"]},{"source":"osv","ecosystem":"Root:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.1-aikido.2"},{"fixed":"2.21.2-aikido.3"},{"fixed":"3.1.1-aikido.2"},{"fixed":"2.21.1-aikido.3"},{"fixed":"2.21.1-aikido.4"},{"fixed":"2.21.2-aikido.4"},{"fixed":"2.21.2-aikido.5"},{"fixed":"2.21.4-aikido.1"},{"fixed":"2.21.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-aikido.2"},{"fixed":"3.1.1-aikido.3"},{"fixed":"3.1.0-aikido.3"},{"fixed":"3.1.1-aikido.4"},{"fixed":"3.1.0-aikido.4"},{"fixed":"3.1.0-aikido.5"},{"fixed":"3.1.1-aikido.5"},{"fixed":"3.1.4-aikido.2"},{"fixed":"3.1.4-aikido.3"},{"fixed":"3.1.4-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.1-root.io.2"},{"fixed":"2.21.2-root.io.3"},{"fixed":"3.1.1-root.io.2"},{"fixed":"2.21.1-root.io.3"},{"fixed":"2.21.1-root.io.4"},{"fixed":"2.21.2-root.io.4"},{"fixed":"2.21.2-root.io.5"},{"fixed":"2.21.4-root.io.1"},{"fixed":"2.21.4-root.io.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.0-root.io.2"},{"fixed":"3.1.1-root.io.3"},{"fixed":"3.1.0-root.io.3"},{"fixed":"3.1.1-root.io.4"},{"fixed":"3.1.0-root.io.4"},{"fixed":"3.1.0-root.io.5"},{"fixed":"3.1.1-root.io.5"},{"fixed":"3.1.4-root.io.2"},{"fixed":"3.1.4-root.io.3"},{"fixed":"3.1.4-root.io.4"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1","2.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.9.3-1","2.10.0-2","2.10.1-1","2.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.12.5-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1build1","2.14.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1build1"]}],"products":[{"vendor":"fasterxml","product":"jackson-databind"}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5967","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5968","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54516","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9fxm-vc8v-hj55"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54516.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54516","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-54516","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54516","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-54516","title":"jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.","status":"published","published":"2026-06-23T20:48:52.73Z","modified":"2026-06-24T13:00:17.78Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T13:38:09.774038Z"}],"euvd":[{"id":"EUVD-2026-38590","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.","status":"published","published":"2026-06-23T20:48:52Z","modified":"2026-06-24T13:00:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:31.123469Z"}],"ghsa":[{"id":"GHSA-9fxm-vc8v-hj55","title":"jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields","description":"## Summary\n`POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty(\"renamed\")` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is retained; during deserialization `BeanDeserializerFactory.addBeanProps()` sees `hasField()==true`, builds a `FieldProperty`, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the `@JsonIgnore` on the setter.\n\n## Impact\nPOJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.21 line: `\u003e= 2.21.0, \u003c 2.21.4` -\u003e fixed in **2.21.4** (backport `c3d56dd`, #5968)\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5967, `e88cb17`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: HIGH. CWE-915.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","status":"published","published":"2026-06-23T21:24:26Z","modified":"2026-07-20T21:21:25Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:40:47.245721Z"}],"nvd":[{"id":"CVE-2026-54516","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.","status":"published","published":"2026-06-23T21:17:02.723Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:12:25.288279Z"}],"osv":[{"id":"CVE-2026-54516","title":"jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.","status":"published","published":"2026-06-23T20:48:52.73Z","modified":"2026-10-28T11:14:32.328216338Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54516","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.","status":"published","published":"2026-06-23T21:17:02.723Z","modified":"2026-10-26T12:02:58.075987701Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-9fxm-vc8v-hj55","title":"jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields","description":"## Summary\n`POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty(\"renamed\")` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is retained; during deserialization `BeanDeserializerFactory.addBeanProps()` sees `hasField()==true`, builds a `FieldProperty`, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the `@JsonIgnore` on the setter.\n\n## Impact\nPOJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.21 line: `\u003e= 2.21.0, \u003c 2.21.4` -\u003e fixed in **2.21.4** (backport `c3d56dd`, #5968)\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5967, `e88cb17`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: HIGH. CWE-915.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","status":"published","published":"2026-06-23T21:24:26Z","modified":"2026-09-10T03:50:49.332051665Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"UBUNTU-CVE-2026-54516","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty(\"renamed\") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.","status":"published","published":"2026-06-23T21:17:00Z","modified":"2026-10-17T12:59:06.070244528Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"CLSA-2026-1793538772","title":"TuxCare security update for tools.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt tools.jackson.core:jackson-databind to address 1 CVE. Fixed in 3.1.2-tuxcare.2.","status":"published","published":"2026-11-01T14:12:53Z","modified":"2026-11-01T20:15:02.59986937Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793867220","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.11.1-tuxcare.5.","status":"published","published":"2026-11-05T09:27:01Z","modified":"2026-11-05T13:15:05.647204229Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793870147","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.15.3-tuxcare.5.","status":"published","published":"2026-11-05T10:15:47Z","modified":"2026-11-05T13:15:09.162879604Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793870277","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.11.4-tuxcare.4.","status":"published","published":"2026-11-05T10:17:58Z","modified":"2026-11-06T13:28:07.298029478Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793870643","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.11.3-tuxcare.5.","status":"published","published":"2026-11-05T10:24:04Z","modified":"2026-11-06T13:28:06.576076749Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793871098","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.11.2-tuxcare.3.","status":"published","published":"2026-11-05T10:31:39Z","modified":"2026-11-05T13:15:09.169903748Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793871562","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.17.0-tuxcare.3.","status":"published","published":"2026-11-05T10:39:23Z","modified":"2026-11-05T13:15:09.166422386Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793871976","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.15.2-tuxcare.5.","status":"published","published":"2026-11-05T10:46:16Z","modified":"2026-11-05T13:15:10.677212629Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793872286","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.15.4-tuxcare.5.","status":"published","published":"2026-11-05T10:51:27Z","modified":"2026-11-05T13:15:08.27390704Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793872559","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.16.0-tuxcare.5.","status":"published","published":"2026-11-05T10:56:00Z","modified":"2026-11-05T13:15:10.069734869Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793873664","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.16.1-tuxcare.4.","status":"published","published":"2026-11-05T11:14:25Z","modified":"2026-11-05T13:15:10.68578294Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793874032","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.17.2-tuxcare.4.","status":"published","published":"2026-11-05T11:20:33Z","modified":"2026-11-05T13:15:08.261666496Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793874263","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.17.3-tuxcare.5.","status":"published","published":"2026-11-05T11:24:24Z","modified":"2026-11-05T13:15:10.687531219Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793957665","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.6.6-tuxcare.4.","status":"published","published":"2026-11-06T10:34:26Z","modified":"2026-11-06T13:15:17.601930544Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793957775","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (11 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 11 CVEs. Fixed in 2.8.11-tuxcare.6.","status":"published","published":"2026-11-06T10:36:15Z","modified":"2026-11-06T13:15:14.77804091Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793958230","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.18.2-tuxcare.4.","status":"published","published":"2026-11-06T10:43:51Z","modified":"2026-11-06T13:15:17.880309455Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1793958328","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (10 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 10 CVEs. Fixed in 2.10.4-tuxcare.4.","status":"published","published":"2026-11-06T10:45:29Z","modified":"2026-11-06T13:15:17.587106909Z","updated_at":"2026-11-06T13:44:09.891978Z"},{"id":"CLSA-2026-1794221927","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.4.0-tuxcare.4.","status":"published","published":"2026-11-09T11:58:48Z","modified":"2026-11-09T19:15:04.843813417Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794222244","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (4 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 4 CVEs. Fixed in 2.4.1-tuxcare.4.","status":"published","published":"2026-11-09T12:04:05Z","modified":"2026-11-09T19:15:02.891677136Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794222386","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (13 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 13 CVEs. Fixed in 2.8.11.4-tuxcare.5.","status":"published","published":"2026-11-09T12:06:27Z","modified":"2026-11-09T19:15:09.533317993Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794223842","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (20 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 20 CVEs. Fixed in 2.9.3-tuxcare.7.","status":"published","published":"2026-11-09T12:30:43Z","modified":"2026-11-09T19:15:09.539297121Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794223928","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.9.5-tuxcare.5.","status":"published","published":"2026-11-09T12:32:10Z","modified":"2026-11-09T19:15:03.930133437Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794223990","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (14 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 14 CVEs. Fixed in 2.8.11.3-tuxcare.5.","status":"published","published":"2026-11-09T12:33:10Z","modified":"2026-11-09T19:15:08.71813093Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794224575","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.9.9-tuxcare.4.","status":"published","published":"2026-11-09T12:42:56Z","modified":"2026-11-09T19:15:03.892515361Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794224690","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (15 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 15 CVEs. Fixed in 2.8.4-tuxcare.7.","status":"published","published":"2026-11-09T12:44:51Z","modified":"2026-11-09T19:15:04.426533193Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794225259","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (19 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 19 CVEs. Fixed in 2.9.1-tuxcare.4.","status":"published","published":"2026-11-09T12:54:20Z","modified":"2026-11-09T19:15:02.893164762Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794225369","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (18 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 18 CVEs. Fixed in 2.9.7-tuxcare.5.","status":"published","published":"2026-11-09T12:56:10Z","modified":"2026-11-09T19:15:08.722624956Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794225420","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.9.9.1-tuxcare.6.","status":"published","published":"2026-11-09T12:57:01Z","modified":"2026-11-09T19:15:05.035896665Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794225652","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (18 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 18 CVEs. Fixed in 2.9.4-tuxcare.6.","status":"published","published":"2026-11-09T13:00:53Z","modified":"2026-11-09T19:15:02.893434073Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226057","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.7.9-tuxcare.6.","status":"published","published":"2026-11-09T13:07:38Z","modified":"2026-11-09T19:15:05.740816879Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226147","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.7.5-tuxcare.7.","status":"published","published":"2026-11-09T13:09:08Z","modified":"2026-11-09T19:15:04.827157739Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226255","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.4.1.1-tuxcare.4.","status":"published","published":"2026-11-09T13:10:56Z","modified":"2026-11-09T19:15:05.33552214Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226417","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.6.7.2-tuxcare.4.","status":"published","published":"2026-11-09T13:13:37Z","modified":"2026-11-09T19:15:08.473507537Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226556","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.6.5-tuxcare.4.","status":"published","published":"2026-11-09T13:15:57Z","modified":"2026-11-09T19:15:02.887983836Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794226743","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (12 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 12 CVEs. Fixed in 2.10.2-tuxcare.5.","status":"published","published":"2026-11-09T13:19:03Z","modified":"2026-11-09T19:15:02.897200168Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794227115","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.5.4-tuxcare.5.","status":"published","published":"2026-11-09T13:25:15Z","modified":"2026-11-09T19:15:09.425098892Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794227208","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.7.3-tuxcare.5.","status":"published","published":"2026-11-09T13:26:49Z","modified":"2026-11-09T19:15:03.886595735Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794227319","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.1.4-tuxcare.3.","status":"published","published":"2026-11-09T13:28:40Z","modified":"2026-11-09T19:15:02.89597065Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794228139","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.8.10-tuxcare.7.","status":"published","published":"2026-11-09T13:42:20Z","modified":"2026-11-09T19:15:03.890964483Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229294","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.7.9.3-tuxcare.5.","status":"published","published":"2026-11-09T14:01:35Z","modified":"2026-11-09T19:15:09.624620005Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229539","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.9.10.7-tuxcare.5.","status":"published","published":"2026-11-09T14:05:40Z","modified":"2026-11-09T19:15:03.896608093Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229558","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.6.4-tuxcare.3.","status":"published","published":"2026-11-09T14:05:58Z","modified":"2026-11-09T19:15:08.473354827Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229591","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.2.3-tuxcare.4.","status":"published","published":"2026-11-09T14:06:32Z","modified":"2026-11-09T19:15:04.839566536Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229674","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.10.5.1-tuxcare.5.","status":"published","published":"2026-11-09T14:07:54Z","modified":"2026-11-09T19:15:02.870450723Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229690","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.7.0-tuxcare.5.","status":"published","published":"2026-11-09T14:08:11Z","modified":"2026-11-09T19:15:08.471565825Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794229701","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.6.3-tuxcare.5.","status":"published","published":"2026-11-09T14:08:21Z","modified":"2026-11-09T19:15:04.838431733Z","updated_at":"2026-11-09T19:38:09.278998Z"}]},"sources_more":{"osv":13}}