Copyright © 2012 Red Hat, Inc. All rights reserved.
Moderate
2026-06-23T20:50:25
jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-915
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
A flaw was found in jackson-databind. This vulnerability occurs in the data-binding functionality where properties intended to be ignored are incorrectly restored and become writable again. An attacker could potentially exploit this by providing input that modifies data through these supposedly ignored properties. This could lead to unintended changes in application data, impacting data integrity.
This is a Moderate impact flaw in jackson-databind where applications enabling case-insensitive property matching alongside per-property @JsonIgnoreProperties may inadvertently expose fields to unauthorized modification. This bypass of intended property exclusions could lead to data integrity issues within affected Red Hat products.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Cryostat 4
Fix deferred
jackson-databind
OpenShift Developer Tools and Services
Fix deferred
jenkins
OpenShift Developer Tools and Services
Fix deferred
jenkins-2-plugins
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel8
OpenShift Developer Tools and Services
Fix deferred
ocp-tools-4/jenkins-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-dispatcher-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-ekb-receiver-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9
OpenShift Serverless
Fix deferred
openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9
Red Hat AI Inference Server
Fix deferred
rhaiis/vllm-cuda-rhel9
Red Hat AI Inference Server
Fix deferred
rhaii/vllm-gaudi-rhel9
Red Hat AMQ Broker 7
Fix deferred
jackson-databind
Red Hat AMQ Clients
Fix deferred
jackson-databind
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-minimal-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
ansible-automation-platform-27/de-supported-rhel9
Red Hat Ansible Automation Platform 2
Fix deferred
python3.11-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3.12-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python3x-drools-jpy-jar
Red Hat Ansible Automation Platform 2
Fix deferred
python-drools-jpy-jar
Red Hat build of Apache Camel 4 for Quarkus 3
Not affected
jackson-databind
Red Hat build of Apache Camel for Spring Boot 4
Fix deferred
jackson-databind
Red Hat build of Apache Camel - HawtIO 4
Fix deferred
jackson-databind
Red Hat build of Apicurio Registry 3
Fix deferred
jackson-databind
Red Hat build of Debezium 3
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
jackson-databind
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk/keycloak-rhel9-operator
Red Hat Build of Keycloak
Fix deferred
rhbk-openshift-rhel9/rhbk-openshift-rhel9
Red Hat Build of Keycloak
Fix deferred
rhbk-rhel9-operator/rhbk-rhel9-operator
Red Hat build of Quarkus
Affected
jackson-databind
Red Hat Certificate System 10
Fix deferred
redhat-pki:10/redhat-pki
Red Hat Data Grid 8
Fix deferred
jackson-databind
Red Hat Enterprise Linux 10
Fix deferred
dogtag-pki
Red Hat Enterprise Linux 8
Fix deferred
pki-deps:10.6/jackson-databind
Red Hat Enterprise Linux 9
Fix deferred
jackson-databind
Red Hat Enterprise Linux AI (RHEL AI) 3
Fix deferred
rhelai3/bootc-gaudi-rhel9
Red Hat Fuse 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk11-openshift-rhel8/eap74-els-openjdk11-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk17-openshift-rhel8/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
eap74-els-openjdk8-openshift-rhel8/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 7
Fix deferred
jboss-eap-7/eap74-els-openjdk8-openshift-rhel8
Red Hat JBoss Enterprise Application Platform 8
Fix deferred
jackson-databind
Red Hat JBoss Enterprise Application Platform Expansion Pack
Fix deferred
jackson-databind
Red Hat Lightspeed for Runtimes Operator
Fix deferred
rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Red Hat Offline Knowledge Portal
Fix deferred
offline-knowledge-portal/rhokp-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-modelmesh-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-spark-operator-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cpu-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch210-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-cuda130-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-th06-rocm64-torch291-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-trustyai-service-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-vllm-gaudi-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9
Red Hat OpenShift AI (RHOAI)
Fix deferred
rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/multicluster-redirector-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/openvsx-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/pluginregistry-rhel9
Red Hat OpenShift Dev Spaces
Fix deferred
devspaces/server-rhel9
Red Hat Satellite 6
Fix deferred
candlepin
Red Hat Satellite 6
Fix deferred
openvox-server
Red Hat Satellite 6
Fix deferred
puppetserver
Red Hat Satellite 6
Fix deferred
satellite:el8/candlepin
Red Hat Satellite 6
Fix deferred
satellite:el8/puppetserver
Red Hat Single Sign-On 7
Fix deferred
jackson-databind
streams for Apache Kafka 2
Fix deferred
jackson-databind
streams for Apache Kafka 3
Fix deferred
jackson-databind
https://www.cve.org/CVERecord?id=CVE-2026-54515
https://nvd.nist.gov/vuln/detail/CVE-2026-54515
https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa
https://github.com/FasterXML/jackson-databind/issues/5962
https://github.com/FasterXML/jackson-databind/issues/5964
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v