Vulnerability in FasterXML jackson-databind

[ Description ]Official description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR21 Oct 2026CERTFR-2026-AVI-1349

  Multiple vulnerabilities in Oracle Database Server Translated from French

  Multiple vulnerabilities have been discovered in Oracle Database Server. Some of them allow an attacker to cause remote arbitrary code execution, remote denial of service and a breach of data confidentiality.

  CVE-2026-91499CVE-2026-93565CVE-2026-93494+41 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4092

  Oracle Commerce: Multiple vulnerabilities Translated from German

  Risk mediumCVE-2026-49844CVE-2026-101560CVE-2026-54515
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4059

  Oracle REST Data Services: Multiple vulnerabilities Translated from German

  CVE-2026-101360CVE-2026-101382CVE-2026-101377+32 more CVEs
• CERT-FR16 Oct 2026CERTFR-2026-AVI-1336

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
• CERT-FR9 Oct 2026CERTFR-2026-AVI-1291

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1256

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-27980CVE-2026-58055CVE-2026-49978+360 more CVEs
• BSI CERT-Bund27 Sep 2026WID-SEC-2026-3595

  IBM QRadar SIEM: Multiple vulnerabilities Translated from German

  CVE-2025-54518CVE-2026-44186CVE-2026-59878+151 more CVEs

[ References ]References

• github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6vx_refsource_CONFIRM
• github.com/FasterXML/jackson-databind/issues/5962x_refsource_MISC
• github.com/FasterXML/jackson-databind/issues/5964x_refsource_MISC
• github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fax_refsource_MISC