CVE-2026-54516

🗓️ 23 Jun 2026 20:48:52Reported by MendType

mend🔗 www.mend.io👁 4 Views

Insecure deserialization in jackson-databind allows writing to private fields.

Reporter	Title	Published	Views	Family All 928
FreeBSD	jackson-databind -- multiple vulnerabilities	28 May 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (Yosemite 2.0)	23 Oct 202606:39	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in source-map.js, FasterXML jackson databind, and Bouncy Castle for Java in IBM Content Navigator and Content Cortex for Microsoft Office	2 Nov 202616:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs	12 Aug 202620:39	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in jackson-databind affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	2 Nov 202614:04	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been detected in IBM Security Verify Governance Identity Manager Adapters	13 Jul 202606:22	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in Jackson Databind	16 Oct 202617:59	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect for Manufacturing is vulnerable to multiple vulnerabilities due to Apache Log4j API and jackson-databind	29 Jul 202614:19	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities.	24 Oct 202604:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	8 Jul 202616:15	–	ibm

Vulners

Node

OR

fasterxml jackson-databindRange2.21.0–2.21.4

fasterxml jackson-databindRange3.0.0–3.1.4

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54516.json
github	www.github.com/FasterXML/jackson-databind/pull/5967
github	www.github.com/FasterXML/jackson-databind/commit/c3d56dd25d52319828147c5b9aeabf2d485c250a
github	www.github.com/FasterXML/jackson-databind
github	www.github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55
github	www.github.com/FasterXML/jackson-databind/commit/e88cb17006b6af4883b973058f0bb6486e5074af
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-54516
github	www.github.com/FasterXML/jackson-databind/pull/5968

07 Oct 2026 22:49Current

6.4Medium risk

Vulners AI Score6.4

CVSS 3.15.3

CVSS 46.9

EPSS0.00449

SSVC

jackson-databind deserialization FieldProperty MapperFeature.INFER_PROPERTY_MUTATORS BeanDeserializerFactory.addBeanProps()