{"id":"GHSA-9fxm-vc8v-hj55","summary":"jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields","details":"## Summary\n`POJOPropertiesCollector._renameProperties()` allows a property with `@JsonProperty(\"renamed\")` on the getter and `@JsonIgnore` on the setter to be renamed rather than dropped. With `MapperFeature.INFER_PROPERTY_MUTATORS` enabled (default), the private backing field is retained; during deserialization `BeanDeserializerFactory.addBeanProps()` sees `hasField()==true`, builds a `FieldProperty`, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the `@JsonIgnore` on the setter.\n\n## Impact\nPOJOs combining a renamed getter with an ignored setter (a read-only-over-the-wire pattern) have that field silently set from attacker input (property tampering / mass assignment). Not a general gadget; no RCE.\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.21 line: `\u003e= 2.21.0, \u003c 2.21.4` -\u003e fixed in **2.21.4** (backport `c3d56dd`, #5968)\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5967, `e88cb17`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: HIGH. CWE-915.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","aliases":["CVE-2026-54516"],"modified":"2026-07-20T21:30:31.986122419Z","published":"2026-06-23T21:24:26Z","database_specific":{"github_reviewed_at":"2026-06-23T21:24:26Z","nvd_published_at":"2026-06-23T21:17:02Z","cwe_ids":["CWE-915"],"severity":"MODERATE","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54516"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/pull/5967"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/pull/5968"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a"},{"type":"WEB","url":"https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af"},{"type":"PACKAGE","url":"https://github.com/FasterXML/jackson-databind"}],"affected":[{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.0"},{"fixed":"2.21.4"}]}],"versions":["2.21.0","2.21.1","2.21.2","2.21.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fxm-vc8v-hj55/GHSA-9fxm-vc8v-hj55.json"}},{"package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fxm-vc8v-hj55/GHSA-9fxm-vc8v-hj55.json"}},{"package":{"name":"tools.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9fxm-vc8v-hj55/GHSA-9fxm-vc8v-hj55.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}