CVE-2026-54516

Katalog CVE

CVSS 5.3 · Medium EPSS 0,45%

Kerentanan Improperly Controlled Modification of Dynamically-Determined Object Attributes pada fasterxml jackson-databind. Skor CVSS 3.1 5.3 (Medium) menurut github.com.

Deskripsi (NVD)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.

Rincian

Terbit di NVD

23 Juni 2026

Terakhir diubah

27 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55 advisory vendor
• https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a patch
• https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af patch
• https://github.com/FasterXML/jackson-databind/pull/5967 issue tracking · patch
• https://github.com/FasterXML/jackson-databind/pull/5968 issue tracking · patch