The jackson-databind library versions 2.8.0 up to but not including 2.18.9, 2.21.5, and 3.1.4 contain a vulnerability in the BeanDeserializerBase.createContextual() method. When per-property @JsonIgnoreProperties exclusions are applied, the filtered BeanPropertyMap removes ignored properties. However, a subsequent case-insensitivity block triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) incorrectly rebuilds the property map from the original unfiltered map, overwriting the filtered map and restoring ignored properties as writable. This improper modification of dynamically-determined object attributes can lead to unintended property writes. The issue is tracked as CWE-915 and has a CVSS 3.1 score of 5.3 (medium severity).

The vulnerability allows ignored properties that should be excluded from deserialization to be writable again, potentially enabling attackers to modify object attributes that were intended to be protected. This could lead to integrity issues in applications using affected jackson-databind versions. There is no indication of confidentiality or availability impact. No known exploits in the wild have been reported.

This vulnerability is fixed in jackson-databind versions 2.18.9, 2.21.5, and 3.1.4. Users should upgrade to one of these fixed versions to remediate the issue. Patch status is confirmed by the vendor advisory. No alternative mitigations are indicated.