5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54516

CVE-2026-54516: jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54516

CVE-2026-54516:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.fasterxml.jackson.core:jackson-databind	maven	>= 2.21.0, < 2.21.4	2.21.4
com.fasterxml.jackson.core:jackson-databind	maven	>= 3.0.0, < 3.1.4	3.1.4
tools.jackson.core:jackson-databind	maven	>= 3.0.0, < 3.1.4	3.1.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows an attacker to bypass the @JsonIgnore annotation on a setter method and deserialize data into a private field. This occurs when a getter for the same property is annotated with @JsonProperty to rename it. The POJOPropertiesCollector._renameProperties method, prior to the patch, would not correctly handle this combination of annotations. It would fail to mark the property as read-only, and because of the MapperFeature.INFER_PROPERTY_MUTATORS feature (enabled by default), it would retain the private field as a potential mutator. During deserialization, BeanDeserializerFactory.addBeanProps() would then create a FieldProperty for this private field, allowing it to be written to directly from the JSON input if the renamed property key is present. The patch fixes this by adding a call to prop.removeFields() within _renameProperties for the affected properties, which strips the inferred field mutator and ensures the property is treated as read-only during deserialization, thus preventing the property tampering.

Vulnerable functions

com.fasterxml.jackson.databind.introspect.POJOPropertiesCollector._renameProperties

src/main/java/com/fasterxml/jackson/databind/introspect/POJOPropertiesCollector.java

The vulnerability lies in the `_renameProperties` method within the `POJOPropertiesCollector` class. This method was responsible for handling property renaming, but it failed to correctly process properties where the setter was marked with `@JsonIgnore` and the getter was renamed using `@JsonProperty`. This oversight allowed the private backing field to be incorrectly exposed for deserialization. The patch rectifies this by explicitly removing field mutators for such properties, ensuring they remain read-only as intended.

tools.jackson.databind.introspect.POJOPropertiesCollector._renameProperties

src/main/java/tools/jackson/databind/introspect/POJOPropertiesCollector.java

This is the same vulnerability as in `com.fasterxml.jackson.databind.introspect.POJOPropertiesCollector._renameProperties`, but in a different package path for later versions of the library. The `_renameProperties` method in `tools.jackson.databind.introspect.POJOPropertiesCollector` allows deserialization into a private field even when the setter is ignored, due to incorrect handling of renamed properties. The fix is identical, adding a call to `prop.removeFields()` to prevent the private field from being used as a mutator.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.