CVE catalog

CVE-2026-54515

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual

[CVE catalog]

Severity
Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 27, 2026

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjackson-databindsid2.22.4-1fixed
Debianjackson-databindforky2.22.4-1fixed
Debianjackson-databindtrixie2.14.0+ds-1+deb13u1vulnerable
Debianjackson-databindtrixie-security2.14.0+ds-1+deb13u1vulnerable
Debianjackson-databindbookworm2.14.0-1+deb12u1vulnerable
Debianjackson-databindbookworm-security2.14.0-1+deb12u1vulnerable
Cpejackson-databindNot reportedNot reportedvulnerable
Cpejackson-databindNot reported2.18.9fixed
Cpejackson-databindNot reported2.21.5fixed
Cpejackson-databindNot reported3.1.4fixed
Cpejackson-databindNot reportedNot reportedunknown
Susejackson-annotationslinux enterprise server 16.02.18.9-160000.1.1fixed
Susejackson-corelinux enterprise server 16.02.18.9-160000.1.1fixed
Susejackson-databindlinux enterprise server 16.02.18.9-160000.1.1fixed
Susejackson-annotationslinux enterprise server for sap applications 16.02.18.9-160000.1.1fixed
Susejackson-corelinux enterprise server for sap applications 16.02.18.9-160000.1.1fixed
Susejackson-databindlinux enterprise server for sap applications 16.02.18.9-160000.1.1fixed
Susejackson-annotationslinux enterprise module for basesystem 15 sp72.18.9-150200.3.25.1fixed
Susejackson-corelinux enterprise module for basesystem 15 sp72.18.9-150200.3.25.1fixed
Susejackson-databindlinux enterprise module for basesystem 15 sp72.18.9-150200.3.33.1fixed
Susejackson-dataformats-binarylinux enterprise module for development tools 15 sp72.18.9-150200.3.24.1fixed
Opensusejackson-annotationsleap 16.02.18.9-160000.1.1fixed
Opensusejackson-coreleap 16.02.18.9-160000.1.1fixed
Opensusejackson-databindleap 16.02.18.9-160000.1.1fixed
Cpejackson-databindNot reportedNot reportedunknown

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjackson-databindsourcesid2.18.11-1not yet assignedNot reported[1145887]
Debianjackson-databindsourceforky2.18.11-1not yet assignedNot reported[1145887]
Debianjackson-databindsourcetrixie(unfixed)not yet assignedNot reported[1145887]
Debianjackson-databindsourcebookworm(unfixed)not yet assignedNot reported[1145887]
Cpejackson-databindcpeNot reported2.18.9Not reportedNot reportedNot reported
Cpejackson-databindcpeNot reported2.21.5Not reportedNot reportedNot reported
Cpejackson-databindcpeNot reported3.1.4Not reportedNot reportedNot reported
Susejackson-annotationsrpmlinux enterprise server 16.02.18.9-160000.1.1Not reportedSUSE-SU-2026:22822-1Not reported
Susejackson-corerpmlinux enterprise server 16.02.18.9-160000.1.1Not reportedSUSE-SU-2026:22822-1Not reported
Susejackson-databindrpmlinux enterprise server 16.02.18.9-160000.1.1Not reportedSUSE-SU-2026:22822-1Not reported
Susejackson-annotationsrpmlinux enterprise server for sap applications 16.02.18.9-160000.1.1Not reportedSUSE-SU-2026:22822-1Not reported
Susejackson-corerpmlinux enterprise server for sap applications 16.02.18.9-160000.1.1Not reportedSUSE-SU-2026:22822-1Not reported
Susejackson-databindrpmlinux enterprise server for sap applications 16.02.18.9-160000.1.1Not reportedSUSE-SU-2026:22822-1Not reported
Susejackson-annotationsrpmlinux enterprise module for basesystem 15 sp72.18.9-150200.3.25.1Not reportedSUSE-SU-2026:3273-1Not reported
Susejackson-corerpmlinux enterprise module for basesystem 15 sp72.18.9-150200.3.25.1Not reportedSUSE-SU-2026:3273-1Not reported
Susejackson-databindrpmlinux enterprise module for basesystem 15 sp72.18.9-150200.3.33.1Not reportedSUSE-SU-2026:3273-1Not reported
Susejackson-dataformats-binaryrpmlinux enterprise module for development tools 15 sp72.18.9-150200.3.24.1Not reportedSUSE-SU-2026:3273-1Not reported
Opensusejackson-annotationsrpmleap 16.02.18.9-160000.1.1Not reportedOPENSUSE-SU-2026:21375-1Not reported
Opensusejackson-corerpmleap 16.02.18.9-160000.1.1Not reportedOPENSUSE-SU-2026:21375-1Not reported
Opensusejackson-databindrpmleap 16.02.18.9-160000.1.1Not reportedOPENSUSE-SU-2026:21375-1Not reported

[Debian bug #1145887]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjackson2-databind-java]Affected

    Source package: [jackson-databind]

    Details (4)

    • 2.14.0-1+deb12u1 · all · bookworm

      Affected

      nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12

    • 2.14.0-1+deb12u1 · all · bookworm

      Affected

      nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12

    • 2.14.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12

    • 2.14.0-1+deb12u1 · all · bookworm-security

      Affected

      nvd · jackson-databind · debian · bookworm; nvd · jackson-databind · debian · 12

[Debian 13 (Trixie)]

  • [libjackson2-databind-java]Affected

    Source package: [jackson-databind]

    Details (4)

    • 2.14.0+ds-1+deb13u1 · all · trixie

      Affected

      nvd · jackson-databind · debian · 13

    • 2.14.0+ds-1+deb13u1 · all · trixie

      Affected

      nvd · jackson-databind · debian · 13

    • 2.14.0+ds-1+deb13u1 · all · trixie-security

      Affected

      nvd · jackson-databind · debian · 13

    • 2.14.0+ds-1+deb13u1 · all · trixie-security

      Affected

      nvd · jackson-databind · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]