Improperly Controlled Modification of Dynamically-Determined Object Attributes in jackson-databind - CVE-2026-54515

Vulnerability identifier: #VU139156

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-54515

CWE-ID: CWE-915

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to modify otherwise ignored object attributes.

The vulnerability exists due to improper control of dynamically determined object attributes in BeanDeserializerBase.createContextual() when processing case-insensitive deserialization with per-property @JsonIgnoreProperties exclusions. A remote attacker can send crafted JSON input to modify otherwise ignored object attributes.

Only applications that enable case-insensitive property matching and rely on per-property @JsonIgnoreProperties to keep a field unwritable are vulnerable.

jackson-databind
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
Development Tools Module
Basesystem Module
Fedora
Rational Test Virtualization Server
WebSphere Automation
PowerVC
IBM Sterling Connect:Direct Web Services
IBM Common Licensing
IBM Maximo Application Suite - Manage Component
IBM Operator for Apache Flink
Red Hat build of Quarkus
IBM SPSS Collaboration and Deployment Services
Netezza Appliance
Db2 Bridge
CICS Transaction Gateway Desktop Edition
DevOps Test Virtualization
DevOps Test Integrations and APIs
webMethods developer portal
webMethods ControlPlane
Guardium Data Protection
IBM Engineering Systems Design Rhapsody
Terracotta
jackson-dataformat-cbor
jackson-core
jackson-annotations
jackson-databind
jackson-parent
jackson-modules-base
jackson-jaxrs-providers
jackson-bom
fasterxml-oss-parent
EntireX

Install security update from vendor's website.

jackson-databind - addressed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.4
Netezza Appliance - update to 1.0.2.0
Db2 Bridge - update to 1.1.5.1
WebSphere Automation - update to 1.13.0
IBM Sterling Connect:Direct Web Services - addressed in versions 6.3.0.20, 6.4.0.9
IBM Common Licensing - update to 9.1
IBM Maximo Application Suite - Manage Component - addressed in versions 9.0.28, 9.1.20, 9.2.1
DevOps Test Virtualization - update to 12.0.0
DevOps Test Integrations and APIs - update to 12.0.0
webMethods developer portal - update to 11.1 Fix16
webMethods ControlPlane - update to 11.1 Fix11
Guardium Data Protection - update to 12.2.3
jackson-dataformat-cbor - addressed in versions 2.18.8-150200.3.21.3, 2.18.9-150200.3.24.1
jackson-core - addressed in versions 2.18.8-150200.3.22.3, 2.18.9-150200.3.25.1
jackson-annotations - addressed in versions 2.18.8-150200.3.22.3, 2.18.9-150200.3.25.1
jackson-databind - addressed in versions 2.18.8-150200.3.28.2, 2.18.9-150200.3.33.1
jackson-parent - update to 2.21-1.fc45
jackson-annotations - update to 2.21-6.fc45
jackson-modules-base - update to 2.21.5-1.fc45
jackson-jaxrs-providers - update to 2.21.5-1.fc45
jackson-databind - update to 2.21.5-1.fc45
jackson-core - update to 2.21.5-1.fc45
jackson-bom - update to 2.21.5-1.fc45
fasterxml-oss-parent - update to 75-1.fc45
IBM Operator for Apache Flink - update to 1.5.5
Red Hat build of Quarkus - addressed in versions 3.27.4.SP2, 3.33.2.SP2
IBM SPSS Collaboration and Deployment Services - addressed in versions 8.4.0.0 IF005, 8.5.0.0 IF005, 8.6.0.0 IF005
IBM Engineering Systems Design Rhapsody - addressed in versions 10.0.0.6, 10.0.1.0.7, 10.0.2.0.5, 10.0.3.0.2
Terracotta - addressed in versions 10.15.0.38, 11.1.0.21, 12.1.0.3
EntireX - update to 12.1.0.0003-0779

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v
• https://github.com/FasterXML/jackson-databind/pull/5964

• Multiple vulnerabilities in jackson-databind
• Fedora 45 update for fasterxml-oss-parent, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jackson-parent
• SUSE update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition
• SUSE update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM WebSphere Automation
• Multiple vulnerabilities in IBM EntireX
• Multiple vulnerabilities in IBM Db2 Bridge
• Multiple vulnerabilities in IBM Maximo Application Suite - Manage Component
• Multiple vulnerabilities in IBM Netezza Appliance
• Multiple vulnerabilities in Red Hat build of Quarkus 3.27.4
• Multiple vulnerabilities in Red Hat build of Quarkus 3.33.2
• Multiple vulnerabilities in IBM Common Licensing
• Multiple vulnerabilities in IBM Terracotta
• Multiple vulnerabilities in IBM Operator for Apache Flink
• Multiple vulnerabilities in IBM Guardium Data Protection
• Multiple vulnerabilities in IBM Engineering Systems Design Rhapsody
• Multiple vulnerabilities in IBM webMethods Developer Portal and IBM webMethods ControlPlane
• Multiple vulnerabilities in IBM PowerVC
• Multiple vulnerabilities in IBM DevOps Test Virtualization/IBM DevOps Test Integrations and APIs