CVE-2026-40899: Lombok Data Class List Field Missing Jsonignore
A List<String> field initialized via Arrays.asList() in a Lombok @Data-annotated class is missing @JsonIgnore. The @Data annotation auto-generates a public setter for this field. During Jackson JSON deserialization, an attacker can include this field in a crafted JSON payload to overwrite the server-side value, potentially bypassing security validation (e.g.
Javagreprules fetch cve-2026-40899-lombok-data-class-list-field-missing-jsonignore --engine opengrepDescription
A List<String> field initialized via Arrays.asList() in a Lombok @Data-annotated class is missing @JsonIgnore. The @Data annotation auto-generates a public setter for this field. During Jackson JSON deserialization, an attacker can include this field in a crafted JSON payload to overwrite the server-side value, potentially bypassing security validation (e.g.
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.