FasterXML jackson-databind up to 2.18.8/2.21.4/3.1.3 BeanDeserializerBase.createContextual dynamically-determined object attributes

Summaryinfo

A vulnerability classified as problematic was found in FasterXML jackson-databind up to 2.18.8/2.21.4/3.1.3. This affects the function BeanDeserializerBase.createContextual. Such manipulation leads to dynamically-determined object attributes. This vulnerability is referenced as CVE-2026-54515. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in FasterXML jackson-databind up to 2.18.8/2.21.4/3.1.3 and classified as problematic. Affected by this issue is the function BeanDeserializerBase.createContextual. The manipulation with an unknown input leads to a dynamically-determined object attributes vulnerability. Using CWE to declare the problem leads to CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. Impacted is integrity. CVE summarizes:

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-54515 since 06/15/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 2.18.9, 2.21.5 or 3.1.4 eliminates this vulnerability. Applying the patch 0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38591). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Vendor

• FasterXML

Name

• jackson-databind

Version

• 2.18.0
• 2.18.1
• 2.18.2
• 2.18.3
• 2.18.4
• 2.18.5
• 2.18.6
• 2.18.7
• 2.18.8
• 2.21.0
• 2.21.1
• 2.21.2
• 2.21.3
• 2.21.4
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3

License

• open-source

Website

• Product: https://github.com/FasterXML/jackson-databind/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion