The bug in Jackson DataBind’s property renaming logic allows a JSON payload that names a property with @JsonProperty while the setter is ignored via @JsonIgnore to write directly to the private backing field. This bypasses intended encapsulation and can alter internal state that should remain immutable or read‑only, potentially compromising data integrity or deflecting logic dependent on those values. The underlying weakness is reflected in CWE‑-915, where the framework incorrectly picks the backing field as writeable when a property is renamed during Java Bean analysis.

The flaw affects FasterXML’s jackson‑databind library in releases from 2.21.0 through 2.21.4 and in older 3.1.x series up to, but not including, 3.1.4. Version 3.1.4 and later contain the fix and should be considered safe.

With a CVSS score of 5.3, the vulnerability poses a moderate risk. The EPSS score is not available, hinting that large‑scale exploitation has not yet been observed, and it is not listed in CISA’s KEV catalog for known exploitation. An attacker can potentially exploit the issue by sending a crafted JSON string to any application that accepts deserialization via Jackson, especially if the payload is constructed to rename a property so that the setter is ignored but the property is still bound to the private field. The default MapperFeature.INFER_PROPERTY_MUTATORS setting is necessary for the flaw to manifest, so applications that have explicitly disabled this feature are less likely to be affected.