CVE-2026-54515

Data: 2026-07-01

Severity: Medium

CVSS Score:

  • CVE-2026-54515: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Riferimenti:

Libreria: com.fasterxml.jackson.core:jackson-databind

  • GovWay 3.4.x: <= 2.22.0

  • GovWay 3.3.x: <= 2.18.8

Descrizione

Vulnerability in the jackson-databind library, detected by the CI environment via OSV-Scanner. The following is the official NVD description.

[CVE-2026-54515] (GHSA-5jmj-h7xm-6q6v) - CVSS 5.3 (Medium)

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, 2.22.1 and 3.1.4.

GovWay

Questa vulnerabilità era già stata segnalata, insieme alle altre della medesima famiglia, nell’avviso CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, dove era stata affrontata aggiornando la libreria com.fasterxml.jackson.core:jackson-databind alla versione 2.22.0 (branch 3.4.x) e 2.18.8 (branch 3.3.x).

Tali versioni risolvono le altre vulnerabilità della famiglia ma non la presente CVE-2026-54515, la cui correzione è disponibile esclusivamente a partire dalle versioni 2.18.9, 2.21.5, 2.22.1 e 3.1.4 della libreria.

Versione affette:

  • 3.3.x: <= 3.3.20

  • 3.4.x: <= 3.4.3

Risoluzione:

  • 3.3.x: prima versione in rilascio

  • 3.4.x: prima versione in rilascio