Homepage

Improperly Controlled Modification of Dynamically-Determined Object Attributes The advisory has been revoked - it doesn't affect any version of package pki-resteasy  (opens in a new tab)

Threat Intelligence

EPSS
0.28% (20th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS9-PKIRESTEASY-17752949
  • published1 Jul 2026
  • disclosed23 Jun 2026
Report a new vulnerability Found a mistake?

Introduced: 23 Jun 2026

NewCVE-2026-54516  (opens in a new tab)
CWE-915  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:9.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pki-resteasy package and not the pki-resteasy package as distributed by Centos.

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4.