CVE-2026-54516: Jackson-databind @JsonIgnore Bypass via Property Renaming

Technical summary

The vulnerability resides in POJOPropertiesCollector._renameProperties() during Jackson's property introspection phase. When a POJO declares a getter with @JsonProperty("renamed") and a setter with @JsonIgnore, the collector renames the property but fails to mark it as ignored. With MapperFeature.INFER_PROPERTY_MUTATORS enabled—the default behavior—BeanDeserializerFactory.addBeanProps() detects the private backing field via hasField()==true and constructs a FieldProperty instance. This FieldProperty is marked writable during deserialization, allowing direct field access that circumvents setter-level access controls. An attacker who controls the JSON input can supply the renamed key to write arbitrary values to the backing field. The root cause is improper sequencing: the renaming logic executes before ignore semantics are fully applied, creating a window where a field can be simultaneously renamed and writable.

Business impact

For applications using Jackson-databind to deserialize untrusted JSON, this vulnerability enables data tampering through fields intended to be read-only or inaccessible. An attacker could modify sensitive application state—such as user roles, permissions, balances, or configuration values—if those fields are backed by properties with conflicting annotations. The impact is limited to integrity (writing) and does not enable information disclosure or denial of service. Organizations heavily dependent on Jackson for REST API backends, microservices, or data pipeline processing should assess exposure. The threat is elevated in cases where deserialized objects directly influence access control or financial transactions.

Affected systems

Jackson-databind versions 2.21.0 through 2.21.4 and 3.1.4 (or prior 3.x versions before the fix) are affected. Any application that includes jackson-databind as a transitive or direct dependency and deserializes untrusted JSON is potentially vulnerable if it uses the annotation pattern described (renamed getter + ignored setter). Spring Boot applications, Quarkus, Micronaut, and other frameworks that bundle Jackson are in scope. Legacy systems still on 2.x releases and newer 3.x deployments are equally affected; the vulnerability is not version-specific to modern releases alone.

Exploitability

Exploitability is straightforward for an attacker with the ability to craft and send JSON payloads to an application. No user interaction, special privileges, or network positioning is required; the attack works over plain HTTP/REST. The attacker must know or guess the renamed property name and the backing field type, but both are typically discoverable through application documentation, decompilation, or error messages. The default configuration (INFER_PROPERTY_MUTATORS enabled) means no special setup by developers is needed to trigger the flaw. However, the attack surface is limited to objects that use the specific annotation combination; applications without @JsonIgnore on setters or without property renaming are unaffected.

Remediation

Upgrade jackson-databind to version 3.1.4 or later. For 2.x users, verify with FasterXML's advisory whether a patch is available for the 2.21.x line; if not, consider migrating to 3.1.4+ or implementing a workaround. As an interim measure, disable MapperFeature.INFER_PROPERTY_MUTATORS on ObjectMapper instances if your application does not rely on automatic field inference, though this may break existing deserialization logic. Audit POJOs that combine @JsonProperty on getters with @JsonIgnore on setters to ensure they are not handling sensitive data; refactoring to use explicit @JsonIgnore at the property level or decoupling read/write models may be prudent.

Patch guidance

FasterXML has released jackson-databind 3.1.4 as the corrected version. Users on 2.21.x should check the FasterXML GitHub repository and advisory pages for backport status; security patches for older minor versions are not always guaranteed. The fix modifies POJOPropertiesCollector and BeanDeserializerFactory to correctly apply ignore semantics before or during field property construction, preventing writable FieldProperty instances from being created for ignored fields. When upgrading, test deserialization of your application's key POJOs to ensure backward compatibility, as changes to property introspection logic can occasionally affect behavior.

Detection guidance

In your environment, identify jackson-databind usage via dependency scanning (Maven, Gradle, pip, etc.). Use Software Composition Analysis (SCA) tools to flag versions 2.21.0–2.21.4 and vulnerable 3.x versions. During code review, search for patterns combining @JsonProperty (with value argument) on getters and @JsonIgnore on setters in POJO classes. Monitor deserialization logs for unexpected field modifications or errors related to property binding. Consider adding defensive validation in business logic: if a field is meant to be immutable after construction, assert its state or use final keywords where feasible. WAF rules can be applied if the application exposes a known renamed JSON key; block or alert on requests that include that key if it is never legitimate.

Why prioritize this

This vulnerability merits timely but not emergency patching. The CVSS score of 5.3 (Medium) reflects that integrity is compromised but confidentiality and availability are not. Prioritize remediation for internet-facing APIs and services that accept JSON from untrusted sources, particularly those handling user account data, financial transactions, or administrative state. Organizations using Jackson for internal tool or batch processing with controlled inputs can defer patching. The annotation pattern (renamed getter + ignored setter) is not ubiquitous, so affected applications are likely a subset. Nonetheless, the ease of exploitation and the default-on nature of INFER_PROPERTY_MUTATORS warrant inclusion in monthly security updates rather than emergency out-of-band patching.

Risk score, explained

CVSS 5.3 (Medium) reflects an unauthenticated network-based attack vector (AV:N, AC:L, PR:N, UI:N), but impact is limited to integrity (I:L) with no confidentiality or availability loss. The score appropriately penalizes the flaw's practical exploitability while acknowledging that payload crafting requires knowledge of the specific annotation pattern and renamed field names. In a threat model where an organization processes hostile JSON regularly (e.g., third-party integrations, public APIs), internal risk rating may be elevated to High; conversely, applications with strict input validation or that do not use the vulnerable annotation combination may lower it. The lack of KEV designation indicates no known active exploitation in the wild as of the published date.

Frequently asked questions