Jackson Databind allows Java Record objects to be populated from JSON. When a PropertyNaming strategy records ignored properties under their original names and then renames them, this order enables an attacker to supply JSON keys that match the renamed names, thereby bypassing @JsonIgnore annotations and causing normally ignored data to be deserialized into the Record constructor. This flaw, identified as CWE‑915 (Primitive Protocol Error), can expose confidential data that was intended to remain hidden.

The vulnerability affects FasterXML’s Jackson Databind library in versions 2.15.0 through 2.18.8, 2.21.4, and 3.1.4 when Java Records are used in conjunction with a PropertyNamingStrategy. Any application that relies on these Jackson Databind releases and processes JSON into Record types is potentially impacted.

The 6.5 score denotes moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Attackers can likely exploit it by supplying crafted JSON payloads, such as over a network API that performs deserialization, with no evidence of code execution or privilege escalation from the available data.