Maven/tools.jackson.core:jackson-databind CVE-2026-54516: medium 5.3, EPSS 0.45%

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

Action: Upgrade tools.jackson.core:jackson-databind to 3.1.4 or later.

Affected

Fixed versions

Sources

• osv: GHSA-9fxm-vc8v-hj55#Maven/tools.jackson.core:jackson-databind
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55
• https://nvd.nist.gov/vuln/detail/CVE-2026-54516
• https://github.com/FasterXML/jackson-databind/pull/5967
• https://github.com/FasterXML/jackson-databind/pull/5968
• https://github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a
• https://github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af
• https://github.com/FasterXML/jackson-databind

CVE-2026-54516 · published 2026-06-23T21:24:26Z · modified 2026-09-10T03:50:49.332051665Z · JSON