CVE-2026-54516 jackson-databind: Renamed @JsonIgnore'd setters can deserialize via private fields
Attackers can bypass @JsonIgnore annotations to modify private fields during JSON deserialization in jackson-databind.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54516?
CVE-2026-54516 is a medium-severity unsafe deserialization vulnerability in Fasterxml Jackson-Databind, published on 23 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.
Weakness: CWE-915
Which versions are affected by CVE-2026-54516?
6 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.21.0 | 2.21.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.21.0 | 2.21.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.4 |
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.4 |
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.4 |
Products include Fasterxml Jackson-Databind.
How do I fix CVE-2026-54516?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.21.4 or 3.1.4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-54516 being exploited?
There is no known exploitation of CVE-2026-54516 in the wild and no public exploit code.
Other vulnerabilities in Fasterxml Jackson-Databind
- CVE-2018-11307 Deserialization of Untrusted Data in jackson-databind
- CVE-2026-54512 jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
- CVE-2026-54513 jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
- CVE-2020-14060 Deserialization of untrusted data in Jackson Databind
- CVE-2021-46877 jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode
Sources
Also known as CLEANSTART-2026-CG97274, CLEANSTART-2026-FI31779, CLEANSTART-2026-II13133, CLEANSTART-2026-PG17779, CLEANSTART-2026-ZG74825, DEBIAN-CVE-2026-54516 and 43 more.