The vulnerability occurs when case‑insensitive deserialization restores properties that were previously excluded with @JsonIgnoreProperties, allowing an attacker to write to fields that should have been ignored. This can let an attacker inject or modify configuration data, compromise data integrity, and in some contexts elevate privileges by changing critical application state.

FasterXML’s jackson-databind is affected. Versions from 2.8.0 up to and including 2.18.8, 2.21.0‑2.21.4, and 3.1.0‑3.1.3 are vulnerable. The issue is resolved in 2.18.9, 2.21.5, and 3.1.4 and later releases.

The CVSS score of 5.3 indicates moderate impact, and the EPSS score is not available, implying no public data on exploitation frequency. The vulnerability is not listed in CISA KEV. It is likely exploitable by crafting JSON payloads that trigger @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES) during deserialization, a common feature in APIs that process arbitrary JSON. An attacker would need to supply such a payload to a component that deserializes data with case‑insensitivity enabled; upon success, previously ignored properties become writable, potentially enabling configuration tampering or unauthorized data manipulation.