Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-54515 Deserialization Property Bypass in jackson-databind via Case-Insensitivity https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54515
Post summary
The post lists CVE‑2026‑54515 with a brief description of a deserialization property bypass in jackson‑databind, but offers no PoC, exploit code, active usage, patch or detailed technical metrics.
🟠 Jackson-databind, Case-Insensitive Deserialization Bypass, #CVE-2026-54515 (Medium) -DC-Jun2026-603 https://dailycve.com/jackson-databind-case-insensitive-deserialization-bypass-cve-2026-54515-medium-dc-jun2026-603/
Post summary
The post announces a new moderate‑severity CVE (CVE-2026-54515) affecting Jackson‑databind, identifying a case‑insensitive deserialization bypass, without providing PoC, exploit, or patch details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | fasterxml | jackson-databind | - | - | - |
| App | fasterxml | jackson-databind | 2.22.0 | - | - |