CVE-2026-54515: jackson-databind @JsonIgnoreProperties Bypass – Integrity Vulnerability

Technical summary

The vulnerability exists in jackson-databind's BeanDeserializerBase.createContextual() method. When deserializing a bean, the code applies per-property @JsonIgnoreProperties exclusions by calling _handleByNameInclusion(), which produces a filtered BeanPropertyMap. However, when case-insensitivity processing (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) executes, it rebuilds the property map from this._beanProperties (the original, unfiltered state) rather than from the contextual, filtered map. This rebuild operation overwrites the filtered map, restoring ignored properties to their writable state. The issue affects jackson-databind versions 2.8.0 through 2.18.8, 2.21.4, and earlier 3.x versions before 3.1.4.

Business impact

Applications using Jackson-databind to deserialize JSON into domain objects with sensitive or protected fields face the risk of unauthorized field modification. For instance, if a REST API endpoint deserializes user input but excludes admin-only fields via @JsonIgnoreProperties, a malicious client could supply JSON that sets those fields if the endpoint also uses @JsonFormat with case-insensitive matching. This could lead to privilege escalation, unauthorized state changes, data integrity violations, or circumvention of access control checks. The practical impact depends on application design; however, any system relying on @JsonIgnoreProperties as a security boundary is at risk.

Affected systems

jackson-databind versions 2.8.0 through 2.18.8, all of 2.19.x through 2.21.4, and 3.0.x through 3.1.3 are vulnerable. Applications must update to 2.18.9, 2.21.5, or 3.1.4 or later. Verify your exact version in your project dependencies or artifact metadata.

Exploitability

Exploitation requires that both conditions be present: @JsonIgnoreProperties must exclude properties on a deserialized class, and @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) must be enabled on the same or related class. Exploitation is straightforward—no special privileges or user interaction are needed—an attacker simply crafts JSON with the ignored property name and submits it. The CVSS score of 5.3 reflects low attack complexity and network accessibility balanced against limited integrity impact (no confidentiality or availability loss), though the business consequence may exceed this numeric rating depending on the sensitive fields exposed.

Remediation

Upgrade jackson-databind to version 2.18.9, 2.21.5, or 3.1.4 or later. For teams on extended-support or legacy versions, evaluate urgency based on whether your codebase combines @JsonIgnoreProperties with @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES). If neither annotation is in use together, risk is minimal. Review your dependency tree, as Jackson is a transitive dependency in many frameworks (Spring Boot, Micronaut, etc.), so check if a parent framework upgrade includes a patched Jackson version.

Patch guidance

Update jackson-databind in your build system: Maven users should update their jackson-databind dependency to ≥2.18.9, ≥2.21.5, or ≥3.1.4; Gradle users should do the same in their build.gradle. For Spring Boot users, upgrading to a Spring Boot version that includes a patched Jackson release is often the simplest path. Run your test suite after upgrading to ensure no breaking changes—Jackson patches at this severity level rarely introduce breaking changes, but validation is prudent. For applications that cannot upgrade immediately, audit deserialization endpoints to identify uses of both @JsonIgnoreProperties and @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) on the same or parent/child bean types.

Detection guidance

Review your codebase for classes decorated with both @JsonIgnoreProperties (with populated value or allowGetters/allowSetters parameters) and @JsonFormat(with ACCEPT_CASE_INSENSITIVE_PROPERTIES). Pay special attention to controller DTOs, request/response objects, and any user-facing deserialization targets. Application-level monitoring can log unexpected field modifications (e.g., via aspect-oriented programming or custom Jackson modules) and correlate them with deserialization events. Intrusion detection may be limited given that exploitation manifests as normal JSON parsing; focus on behavioral detection of unauthorized field writes if possible.

Why prioritize this

Although the CVSS score is moderate (5.3), this vulnerability directly undermines field-level access control—a fundamental security boundary in many applications. The fix is low-risk and readily available. Prioritize patching if your application deserializes untrusted JSON and uses @JsonIgnoreProperties to protect sensitive fields. Lower priority if your codebase does not use both annotations together, or if deserialization is limited to fully trusted sources.

Risk score, explained

CVSS 5.3 (Medium) reflects network-accessible, unauthenticated, easy-to-exploit conditions (AV:N/AC:L/PR:N/UI:N) with integrity impact (I:L) but no confidentiality or availability compromise. The score does not fully capture the business risk of bypassed access controls; organizations should apply context-specific risk multipliers based on the sensitivity of fields typically protected by @JsonIgnoreProperties in their domain.

Frequently asked questions