CVE-2026-54515

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Trends

Current EPSS score: 0.37%• Percentile: 31%

Techniques & Countermeasures

• CWE-915•Improperly Controlled Modification of Dynamically-Determined Object Attributes

  The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Affected Systems

• chainguard•airbyte-server

  < 2.0.0-r8

• chainguard•airbyte-server-fips

  < 2.0.0-r10

• chainguard•airflow-2

  all

• chainguard•airflow-3

  < 3.3.0-r3

• chainguard•airflow-3-iamguarded-compat

  all

• chainguard•akhq

  < 0.27.1-r14

• chainguard•apache-activemq-5.19

  < 5.19.9-r2

• chainguard•apache-activemq-6.1

  < 6.1.8-r10

• chainguard•apache-activemq-6.2

  < 6.2.7-r4

• chainguard•apache-activemq-fips-5.19

  < 5.19.9-r1

• chainguard•apache-activemq-fips-6.1

  all

• chainguard•apache-activemq-fips-6.2

  < 6.2.8-r3

• chainguard•apache-camel-karavan-devmode

  < 4.18.1-r7 | < 4.18.1-r6

• chainguard•apache-hop

  < 2.18.1-r4 | < 2.18.1-r2

• chainguard•apache-hop-fips

  < 2.18.1-r2 | < 2.18.1-r3

• chainguard•apache-nifi

  all | < 2.10.0-r3

• chainguard•apache-nifi-2.11

  all | < 2.11.0-r6

• chainguard•apache-nifi-2.12

  all

• chainguard•apache-nifi-registry

  < 2.10.0-r2

• chainguard•apache-nifi-registry-toolkit

  < 2.10.0-r2

• chainguard•apache-nifi-toolkit

  < 2.10.0-r3

• chainguard•apache-polaris

  all | < 1.7.0-r4

• chainguard•apache-polaris-fips

  all | < 1.7.0-r3

• chainguard•apache-pulsar-4.0

  < 4.0.12-r1

• chainguard•apache-pulsar-4.1

  all

• chainguard•apache-pulsar-4.2

  < 4.2.3-r2

• chainguard•apache-pulsar-fips-4.0

  < 4.0.12-r1

• chainguard•apache-pulsar-fips-4.1

  all

• chainguard•apache-pulsar-fips-4.2

  < 4.2.3-r1

• chainguard•apache-tika-2.9

  < 2.9.4-r18

• chainguard•apache-tika-3.0

  < 3.0.0-r28

• chainguard•apache-tika-3.1

  < 3.1.0-r35

• chainguard•apache-tika-3.2

  < 3.2.3-r15 | < 3.2.3-r18

• chainguard•apache-tika-3.2-compat

  < 3.2.3-r18

• chainguard•apache-tika-3.3

  < 3.3.1-r6

• chainguard•apache-tika-fips-2.9

  < 2.9.4-r10

• chainguard•apache-tika-fips-3.0

  < 3.0.0-r10

• chainguard•apache-tika-fips-3.1

  < 3.1.0-r12

• chainguard•apache-tika-fips-3.2

  < 3.2.3-r10

• chainguard•apache-tika-fips-3.3

  < 3.3.2-r1

• chainguard•apache-tomee-microprofile

  < 10.1.5-r3

• chainguard•apache-tomee-plume

  < 10.1.5-r3

• chainguard•apache-tomee-plus

  < 10.1.5-r3

• chainguard•apicurio-registry

  < 3.3.0-r9

• chainguard•apicurio-registry-3-operator

  < 3.3.0-r9

• chainguard•apicurio-registry-3-operator-fips

  < 3.3.0-r6

• chainguard•apicurio-registry-fips

  < 3.3.0-r6

• chainguard•camunda-8.8

  < 8.8.31-r3

• chainguard•camunda-8.9

  < 8.9.13-r0

• chainguard•camunda-zeebe-8.6

  all

Showing first 50 affected entries in server-rendered view.

References (8)

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v
• https://github.com/FasterXML/jackson-databind/issues/5962
• https://github.com/FasterXML/jackson-databind/issues/5964
• https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa
• https://github.com/FasterXML/jackson-databind
• https://nvd.nist.gov/vuln/detail/CVE-2026-54515
• https://security-tracker.debian.org/tracker/CVE-2026-54515
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54515.json