Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/06/23 9:24 p.m.11 views

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

Summary POJOPropertiesCollector.renameProperties allows a property with @JsonProperty"renamed" on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFERPROPERTYMUTATORS enabled default, the private backing field is retained; during deserialization...

5.3CVSS5.9AI score0.00283EPSS
SaveExploits0References7Affected Software2
Rows per page
Query Builder