Case-insensitive deserialization may use wrong `@JsonIgnoreProperties` [CVE-2026-54515]

[cowtowncoder]

Due to mis-applied _beanProperties, BeanDeserializerBase fails to apply @JsonIgnoreProperties in some cases.

See https://advisories.gitlab.com/maven/tools.jackson.core/jackson-databind/CVE-2026-54515/

[MarkvanOsch]

Sonatype marks 2.22.0 also as vulnerable.

Advisory Deviation Notice:
The Sonatype Security Research team discovered that this vulnerability was introduced in version 2.8.0.rc1 and not 3.1.0 as stated in the advisory.

[marcindabrowski]

Can it be backported to v2.22 branch?

[chadlwilson]

Can it be backported to v2.22 branch?

Probably could be taken up by the community for 2.22, 2.21 (LTS) and 2.18 (LTS) if they are indeed similarly vulnerable?

[cowtowncoder]

If vulnerable, patch to 2.18, merge forward.

[cowtowncoder]

Backporting via #6039 into

• 2.18 (for 2.18.9)
• 2.21 (for 2.21.5)
• 2.22 (for 2.22.1)

Done. Getting patch release will take a while since 2.18.8 and 2.21.5 were just released and it's 2 hours per patch to release (for which I don't have time this week).
But I'll get them out eventually.