CyberRota Analysis
AI-GeneratedThe jackson-databind library in Java versions 2.15.0 through 2.18.8, 2.21.4, and 3.1.4 is vulnerable due to a flaw that allows Java Records to bypass the @JsonIgnore annotation when using a PropertyNamingStrategy, potentially exposing sensitive data. This could lead to unintended data exposure in applications relying on this library for JSON processing. Developers and organizations using affected versions should prioritize upgrading to the fixed versions (2.18.8, 2.21.4, or 3.1.4) to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.