CVE-2026-54516

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass security controls by exploiting an issue in how properties are handled when both @JsonProperty (for renaming) and @JsonIgnore (for ignoring) annotations are used. By supplying a specially crafted JSON key, an attacker can directly write to a private data field, circumventing the intended security restrictions and potentially leading to unexpected data modification.

Moderate: This flaw in jackson-databind allows for property tampering and mass assignment in Red Hat products. When MapperFeature.INFER_PROPERTY_MUTATORS is enabled by default, an attacker can bypass @JsonIgnore annotations on setters by supplying a renamed JSON key, directly writing to private backing fields and circumventing intended security controls.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.