CVE-2026-54515: 
Java vulnerability analysis and mitigation

CVE-2026-54515 is a deserialization flaw in FasterXML jackson-databind where case-insensitive property handling bypasses per-property @JsonIgnoreProperties exclusions, enabling a mass-assignment-style write to fields that should be unwritable. It affects jackson-databind versions 2.8.0 through 2.18.8, 2.19.0 through 2.21.4, 2.22.0, and 3.1.0 through 3.1.3. The vulnerability was reported by Omkhar Arasaratnam, first published on June 16, 2026, and formally assigned a CVE on June 23, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, GHSA Security Advisory).

The root cause (CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes) lies in BeanDeserializerBase.createContextual(). When _handleByNameInclusion() filters out properties listed in a per-property @JsonIgnoreProperties annotation, it produces a contextual deserializer with a restricted BeanPropertyMap. However, the subsequent code block that handles @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) incorrectly reads from this._beanProperties (the original, unfiltered map) rather than contextual._beanProperties (the filtered map), then overwrites the filtered map with the rebuilt unfiltered one — effectively restoring every property that was just excluded. The fix (commit 0e1b0b2, PR #5964) changes one line to source the case-insensitive rebuild from contextual._beanProperties instead (GHSA Security Advisory, Fix Commit). Exploitation requires that the target application simultaneously uses per-property @JsonIgnoreProperties on a field and enables @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) on the same field or its containing class (Github Advisory).

Successful exploitation allows an unauthenticated remote attacker to write arbitrary values to object properties that were explicitly marked as ignored via @JsonIgnoreProperties, enabling a mass-assignment-style attack. The primary impact is an integrity violation — sensitive fields (e.g., privilege flags, admin keys, internal state) that developers intended to be read-only from untrusted JSON can be overwritten. There is no direct confidentiality or availability impact, and the scope is limited to the affected application's data model, though the consequences depend heavily on what the ignored properties control (GHSA Security Advisory, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.35% (27th percentile), indicating a low near-term exploitation probability. NVD's SSVC assessment notes the attack is automatable but technical impact is only partial, and exploitation is currently rated as "none" (Github Advisory).

1. Identify target application: Locate a Java application using a vulnerable version of jackson-databind (2.8.0–2.18.8, 2.19.0–2.21.4, 2.22.0, or 3.1.0–3.1.3) that deserializes untrusted JSON into POJOs.
2. Identify vulnerable annotation combination: Through source code review, API documentation, or behavioral testing, identify a field or class that uses both @JsonIgnoreProperties("<fieldName>") on a property and @JsonFormat(with = JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES) on the same field.
3. Craft malicious JSON payload: Construct a JSON payload that includes the ignored property name (exact case or mixed case, since case-insensitive matching is active), e.g., {"admin":{"adminKey":"ATTACKER_VALUE","username":"alice"}}.
4. Submit payload: Send the crafted JSON to the application endpoint that deserializes into the vulnerable POJO (e.g., via HTTP POST with Content-Type: application/json).
5. Verify write: Confirm that the ignored property was set to the attacker-supplied value, bypassing the @JsonIgnoreProperties guard — for example, by observing changed application behavior, privilege escalation, or a reflected value in a subsequent API response (GHSA Security Advisory, Fix Commit).

• Network: Unexpected JSON payloads containing fields that should be ignored by application logic (e.g., admin keys, privilege flags, internal identifiers) submitted to API endpoints; mixed-case variants of sensitive field names in request bodies.
• Logs: Application logs showing unexpected values in fields annotated with @JsonIgnoreProperties; deserialization of properties that should have been silently dropped, potentially surfacing as downstream business logic anomalies.
• Application Behavior: Privilege escalation or unauthorized state changes in objects where sensitive fields were supposed to be immutable from external input; unexpected values in audit logs for fields that should never be set via API.

Upgrade jackson-databind to one of the patched versions: 2.18.9, 2.21.5, 2.22.1, or 3.1.4 (GHSA Security Advisory). If immediate patching is not feasible, consider disabling case-insensitive property deserialization (ACCEPT_CASE_INSENSITIVE_PROPERTIES) where it is not strictly required, or migrate @JsonIgnoreProperties from per-property annotations to class-level annotations, which are not affected by this bug. Additionally, review application code for sensitive properties protected only by per-property @JsonIgnoreProperties combined with case-insensitive format settings and assess whether those properties could be exploited if written from untrusted input (Github Advisory).

The jackson-databind maintainer (cowtowncoder) classified the severity as "minor" while the reporter rated it "Moderate," reflecting a difference in perspective on real-world exploitability given the specific annotation combination required (GHSA Security Advisory). Community discussion on the fix PR noted that the vulnerability also affects the 2.21 and 2.18 branches, not just 3.1 as initially reported, prompting backport PRs to those branches (Fix PR). Downstream projects such as Azure Kafka Sink for Kusto have already issued dependency bumps to remediate the CVE, and openSUSE and SUSE have issued security advisories for their distributions.