Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to an Improperly Controlled Modification of Object Attributes in jackson-databind (CVE-2026-54515)

Summary IBM Watson Speech Services Cartridge is vulnerable to an Improperly Controlled Modification of Object Attributes in jackson-databind. This is due to a flaw in the per-property case-insensitivity block, that overwrites the filtered map — restoring already removed properties and making...

CVE-2026-54515

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual, per-property @JsonIgnoreProperties exclusions are applied by handleByNameInclusion, producing a...

CVE-2026-54515: Improperly Controlled Modification of Dynamically-Determined Object Attributes

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual, per-property @JsonIgnoreProperties exclusions are applied by handleByNameInclusion, producing a...