FasterXML jackson-databind up to 2.21.3/3.1.3 POJOPropertiesCollector._renameProperties backing dynamically-determined object attributes

Summaryinfo

A vulnerability, which was classified as problematic, has been found in FasterXML jackson-databind up to 2.21.3/3.1.3. This vulnerability affects the function POJOPropertiesCollector._renameProperties. Performing a manipulation of the argument backing results in dynamically-determined object attributes. This vulnerability is identified as CVE-2026-54516. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in FasterXML jackson-databind up to 2.21.3/3.1.3. It has been classified as problematic. This affects the function POJOPropertiesCollector._renameProperties. The manipulation of the argument backing with an unknown input leads to a dynamically-determined object attributes vulnerability. CWE is classifying the issue as CWE-915. The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified. This is going to have an impact on integrity. The summary by CVE is:

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-54516 since 06/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

Upgrading to version 2.21.4 or 3.1.4 eliminates this vulnerability. Applying the patch c3d56dd25d52319828147c5b9aeabf2d485c250a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38590). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Language Software

Vendor

• FasterXML

Name

• jackson-databind

Version

• 2.21.0
• 2.21.1
• 2.21.2
• 2.21.3
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3

License

• open-source

Website

• Product: https://github.com/FasterXML/jackson-databind/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion