CVE-2026-54516: jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields
(updated )
POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter.
References
- github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a
- github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af
- github.com/FasterXML/jackson-databind/pull/5967
- github.com/FasterXML/jackson-databind/pull/5968
- github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55
- github.com/advisories/GHSA-9fxm-vc8v-hj55
- nvd.nist.gov/vuln/detail/CVE-2026-54516
Code Behaviors & Features
Detect and mitigate CVE-2026-54516 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →