Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
•added 2026/06/23 9:24 p.m.•20 views

jackson-databind's renamed @JsonIgnore'd setters can deserialize via private fields

Summary POJOPropertiesCollector.renameProperties allows a property with @JsonProperty"renamed" on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFERPROPERTYMUTATORS enabled default, the private backing field is retained; during deserialization...

5.3CVSS6.3AI score0.00449EPSS
SaveExploits0References7Affected Software2
Rows per page
Query Builder