.. _vulnerabilityManagement_securityAdvisory_2026_CVE-2026-54515:

CVE-2026-54515
~~~~~~~~~~~~~~

Data: 2026-07-01

Severity: Medium

CVSS Score:

- CVE-2026-54515: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Riferimenti:

- `https://nvd.nist.gov/vuln/detail/CVE-2026-54515 <https://nvd.nist.gov/vuln/detail/CVE-2026-54515>`_
- `https://github.com/advisories/GHSA-5jmj-h7xm-6q6v <https://github.com/advisories/GHSA-5jmj-h7xm-6q6v>`_

Libreria: com.fasterxml.jackson.core:jackson-databind

- GovWay 3.4.x: <= 2.22.0
- GovWay 3.3.x: <= 2.18.8

**Descrizione**

Vulnerability in the jackson-databind library, detected by the CI environment via OSV-Scanner. The following is the official NVD description.

[CVE-2026-54515] (GHSA-5jmj-h7xm-6q6v) - CVSS 5.3 (Medium)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.

**GovWay**

Questa vulnerabilità era già stata segnalata, insieme alle altre della medesima famiglia, nell'avviso :ref:`vulnerabilityManagement_securityAdvisory_2026_CVE-2026-54512`, dove era stata affrontata aggiornando la libreria ``com.fasterxml.jackson.core:jackson-databind`` alla versione 2.22.0 (branch 3.4.x) e 2.18.8 (branch 3.3.x).

Tali versioni risolvono le altre vulnerabilità della famiglia ma non la presente CVE-2026-54515, la cui correzione è disponibile esclusivamente a partire dalle versioni 2.18.9, 2.21.5, 2.22.1 e 3.1.4 della libreria.

Versione affette:

- 3.3.x: <= 3.3.20
- 3.4.x: <= 3.4.3

Risoluzione:

- 3.3.x: prima versione in rilascio
- 3.4.x: prima versione in rilascio