Data Binding Vulnerability in Jackson Databind by FasterXML

CVE-2026-54516

What is CVE-2026-54516?

The Jackson Databind library contains a vulnerability in the POJOPropertiesCollector._renameProperties() method. This issue allows an attacker to exploit JSON deserialization processes by utilizing a property with a @JsonProperty annotation on the getter and a @JsonIgnore annotation on the setter. When MapperFeature.INFER_PROPERTY_MUTATORS is enabled by default, this leads to the retention of the private backing field. Thus, an attacker can supply a renamed JSON key, which enables them to directly write to the backing field, circumventing the @JsonIgnore protection on the setter. The issue has been addressed in version 3.1.4.

References