CVE-2026-54515 jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
Attackers can bypass @JsonIgnoreProperties restrictions to modify ignored fields when case-insensitive deserialization is enabled in jackson-databind.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54515?
CVE-2026-54515 is a medium-severity unsafe deserialization vulnerability in Fasterxml Jackson-Databind, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
Weakness: CWE-915
Which versions are affected by CVE-2026-54515?
10 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.5 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.5 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.22.0 | 2.22.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.22.0 | 2.22.1 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.8.0 | 2.18.9 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.8.0 | 2.18.9 |
4 more packages
com.fasterxml.jackson.core:jackson-databind Maven | From 3.1.0 | 3.1.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 3.1.0 | 3.1.4 |
tools.jackson.core:jackson-databind Maven | From 3.1.0 | 3.1.4 |
tools.jackson.core:jackson-databind Maven | From 3.1.0 | 3.1.4 |
Products include Fasterxml Jackson-Databind.
How do I fix CVE-2026-54515?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.21.5, 2.22.1, 2.18.9 or 3.1.4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-54515 being exploited?
There is no known exploitation of CVE-2026-54515 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Fasterxml Jackson-Databind
- CVE-2018-11307 Deserialization of Untrusted Data in jackson-databind
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- CVE-2020-14060 Deserialization of untrusted data in Jackson Databind
- CVE-2021-46877 jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
Sources
Also known as CLEANSTART-2026-DD70166, CLEANSTART-2026-FF85113, CLEANSTART-2026-LF37858, CLEANSTART-2026-MV24279, CLEANSTART-2026-NC55422, CLEANSTART-2026-NQ89106 and 134 more.