CVE-2026-54515 describes a vulnerability in jackson-databind's BeanDeserializerBase.createContextual() method where per-property @JsonIgnoreProperties exclusions are applied correctly initially, removing ignored properties from the BeanPropertyMap. However, when the per-property case-insensitivity feature is enabled via @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES), the code rebuilds the property map from the original unfiltered properties, overwriting the filtered map and restoring the ignored properties as writable. This improper control of dynamically-determined object attributes can lead to ignored properties being writable when they should not be. The vulnerability affects jackson-databind versions >=2.8.0 <2.18.9, >=2.18.0 <2.21.5, and >=3.0.0 <3.1.4, and is fixed in versions 2.18.9, 2.21.5, and 3.1.4.

This vulnerability allows properties that should be ignored (and thus not writable) to become writable again, potentially enabling unintended modification of object attributes during deserialization. The CVSS score of 5.3 (medium severity) reflects that the impact is limited to integrity (I:L) without confidentiality or availability impact, and the attack vector is network with low complexity and no privileges or user interaction required.

A fix is available in jackson-databind versions 2.18.9, 2.21.5, and 3.1.4. Users should upgrade to one of these versions or later to remediate this vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated.