jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
Summary
POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter.
Impact
POJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.
Affected / Patched (verified via git tag --contains)
- 2.21 line:
>= 2.21.0, < 2.21.4-> fixed in 2.21.4 (backportc3d56dd, #5968) - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4 (#5967,e88cb17)
Severity / CWE
Maintainer: minor. Reporter: HIGH. CWE-915.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.fasterxml.jackson.core:jackson-databind | >= 2.21.0, < 2.21.4, >= 3.0.0, < 3.1.4 | 2.21.4, 3.1.4 |
| Java / Kotlin (Maven) | tools.jackson.core:jackson-databind | >= 3.0.0, < 3.1.4 | 3.1.4 |
References
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55
- https://nvd.nist.gov/vuln/detail/CVE-2026-54516
- https://github.com/FasterXML/jackson-databind/pull/5967
- https://github.com/FasterXML/jackson-databind/pull/5968
- https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a
- https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af
- https://github.com/FasterXML/jackson-databind
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N- Weakness (CWE)
CWE-915- Platform
- Java / Kotlin (Maven)
- Package
com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind- Disclosed
- 23.06.2026
- Updated
- 11.10.2026 13:20
Sources and licenses
OSV / GitHub Advisory Database - GHSA-9fxm-vc8v-hj55 - CC BY 4.0
Vulnerability history: tools.jackson.core:jackson-databind
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 15
- First → latest
- 06.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 5
- Medium 10
Disclosures per year
- 2026: 15
-
jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.