CVE-2026-54516 is a medium severity vulnerability in jackson-databind affecting versions >=2.21.0 and <3.1.4. The flaw arises in POJOPropertiesCollector._renameProperties(), where a property annotated with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter is renamed instead of dropped. With the default MapperFeature.INFER_PROPERTY_MUTATORS enabled, the private backing field remains accessible. During deserialization, BeanDeserializerFactory.addBeanProps() detects the field and creates a writable FieldProperty, allowing an attacker to supply a renamed JSON key that writes directly to the backing field, bypassing the setter's @JsonIgnore protection. This can lead to improper modification of object attributes. The vulnerability is resolved in version 3.1.4.

An attacker can bypass the @JsonIgnore annotation on setter methods by directly modifying private backing fields during deserialization, potentially leading to unauthorized modification of object attributes. The vulnerability does not impact confidentiality or availability but can cause integrity issues by allowing injection of unexpected data into objects.

A fix is available in jackson-databind version 3.1.4. Users should upgrade to version 3.1.4 or later to remediate this vulnerability. Patch status is not explicitly stated beyond this fix version, so users should verify with the vendor advisory for the latest remediation guidance.