CVE-2026-59888
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
EUVDEUVD-2026-43957
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
EUVD-2026-43957- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3pjw-73gf-8qr5
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Summary
For Java Records, POJOPropertiesCollector._removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before _renameUsing() applies the PropertyNamingStrategy. After the rename, _ignoredPropertyNames still holds only the pre-rename name, so _ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.
Impact
A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).
Affected / Patched (verified via git tag --contains)
- 2.15-2.18 line:
>= 2.15.0, < 2.18.8-> fixed in 2.18.8 (backportc7c6783) - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4 (#5974,baa2cdf)
Severity / CWE
Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
- Record
GHSA-3pjw-73gf-8qr5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
NVD
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
OSV
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
OSVGHSA-3pjw-73gf-8qr5
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Summary
For Java Records, POJOPropertiesCollector._removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before _renameUsing() applies the PropertyNamingStrategy. After the rename, _ignoredPropertyNames still holds only the pre-rename name, so _ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.
Impact
A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).
Affected / Patched (verified via git tag --contains)
- 2.15-2.18 line:
>= 2.15.0, < 2.18.8-> fixed in 2.18.8 (backportc7c6783) - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4 (#5974,baa2cdf)
Severity / CWE
Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
- Record
GHSA-3pjw-73gf-8qr5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
Show 47 moreShow less
OSVRHLW-2026-09128b29f89dc8ed
Lightwell Security Advisory: jackson-databind 2.17.3.rhlw-00013
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.17.3.rhlw-00013 with backported fixes for CVE-2026-83557, CVE-2026-54512, CVE-2026-54515, CVE-2026-19032, CVE-2026-77310, CVE-2026-54514, CVE-2026-59888, and CVE-2026-54513.
CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
CVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
CVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.17.3 from Maven Central.
- Record
RHLW-2026-09128b29f89dc8ed- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHLW-2026-804d65df1a73952a
Lightwell Security Advisory: jackson-databind 2.18.0.rhlw-00010
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.18.0.rhlw-00010 with backported fixes for CVE-2026-19032, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, and CVE-2026-83557.
CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
CVE-2026-59889: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.18.0 from Maven Central.
- Record
RHLW-2026-804d65df1a73952a- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-59888
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
UBUNTU-CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1789494210 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1.
- Record
CLSA-2026-1789494210- Updated
- 2026-11-02
OSVCLSA-2026-1791487635 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.3-tuxcare.3.
- Record
CLSA-2026-1791487635- Updated
- 2026-11-02
OSVCLSA-2026-1791545828 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.
- Record
CLSA-2026-1791545828- Updated
- 2026-11-02
OSVCLSA-2026-1792441007 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.15.0-tuxcare.1.
- Record
CLSA-2026-1792441007- Updated
- 2026-11-02
OSVCLSA-2026-1792441426 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.4-tuxcare.1.
- Record
CLSA-2026-1792441426- Updated
- 2026-11-02
OSVCLSA-2026-1792441448 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.3-tuxcare.1.
- Record
CLSA-2026-1792441448- Updated
- 2026-11-02
OSVCLSA-2026-1792441664 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.2-tuxcare.1.
- Record
CLSA-2026-1792441664- Updated
- 2026-11-02
OSVCLSA-2026-1792441755 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.18.5-tuxcare.1.
- Record
CLSA-2026-1792441755- Updated
- 2026-11-02
OSVCLSA-2026-1792441929 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.3-tuxcare.1.
- Record
CLSA-2026-1792441929- Updated
- 2026-11-02
OSVCLSA-2026-1792442035 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.0-tuxcare.1.
- Record
CLSA-2026-1792442035- Updated
- 2026-11-02
OSVCLSA-2026-1792475167 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.
- Record
CLSA-2026-1792475167- Updated
- 2026-11-02
OSVCLSA-2026-1792479593 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.2-tuxcare.1.
- Record
CLSA-2026-1792479593- Updated
- 2026-11-02
OSVCLSA-2026-1792479645 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.4-tuxcare.1.
- Record
CLSA-2026-1792479645- Updated
- 2026-11-02
OSVCLSA-2026-1792479649 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.0-tuxcare.1.
- Record
CLSA-2026-1792479649- Updated
- 2026-11-02
OSVCLSA-2026-1792479685 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.20.1-tuxcare.1.
- Record
CLSA-2026-1792479685- Updated
- 2026-11-02
OSVCLSA-2026-1792516705 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.16.0-tuxcare.1.
- Record
CLSA-2026-1792516705- Updated
- 2026-11-02
OSVCLSA-2026-1792516904 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.2-tuxcare.1.
- Record
CLSA-2026-1792516904- Updated
- 2026-11-02
OSVCLSA-2026-1792516966 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.4-tuxcare.1.
- Record
CLSA-2026-1792516966- Updated
- 2026-11-02
OSVCLSA-2026-1792517919 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.0-tuxcare.1.
- Record
CLSA-2026-1792517919- Updated
- 2026-11-02
OSVCLSA-2026-1792517950 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.16.2-tuxcare.1.
- Record
CLSA-2026-1792517950- Updated
- 2026-11-02
OSVCLSA-2026-1792517982 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.1-tuxcare.1.
- Record
CLSA-2026-1792517982- Updated
- 2026-11-02
OSVCLSA-2026-1793201235 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.21.2-tuxcare.1.
- Record
CLSA-2026-1793201235- Updated
- 2026-11-02
OSVCLSA-2026-1793869125 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.6.1-tuxcare.4.
- Record
CLSA-2026-1793869125- Updated
- 2026-11-05
OSVCLSA-2026-1793869236 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.7.1-tuxcare.5.
- Record
CLSA-2026-1793869236- Updated
- 2026-11-05
OSVCLSA-2026-1793869689 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.3-tuxcare.2.
- Record
CLSA-2026-1793869689- Updated
- 2026-11-05
OSVCLSA-2026-1793870483 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.13.1-tuxcare.4.
- Record
CLSA-2026-1793870483- Updated
- 2026-11-05
OSVCLSA-2026-1793871662 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.6-tuxcare.3.
- Record
CLSA-2026-1793871662- Updated
- 2026-11-05
OSVCLSA-2026-1793871768 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.12.5-tuxcare.4.
- Record
CLSA-2026-1793871768- Updated
- 2026-11-05
OSVCLSA-2026-1793871871 No score
TuxCare security update for tools.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt tools.jackson.core:jackson-databind to address 2 CVEs. Fixed in 3.1.2-tuxcare.4.
- Record
CLSA-2026-1793871871- Updated
- 2026-11-05
OSVCLSA-2026-1793872442 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.7-tuxcare.5.
- Record
CLSA-2026-1793872442- Updated
- 2026-11-05
OSVCLSA-2026-1793872782 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.14.2-tuxcare.6.
- Record
CLSA-2026-1793872782- Updated
- 2026-11-05
OSVCLSA-2026-1793873198 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.1-tuxcare.4.
- Record
CLSA-2026-1793873198- Updated
- 2026-11-05
OSVCLSA-2026-1793873326 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.5-tuxcare.4.
- Record
CLSA-2026-1793873326- Updated
- 2026-11-05
OSVCLSA-2026-1793873445 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.4.2-tuxcare.4.
- Record
CLSA-2026-1793873445- Updated
- 2026-11-05
OSVCLSA-2026-1793873541 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.3-tuxcare.3.
- Record
CLSA-2026-1793873541- Updated
- 2026-11-05
OSVCLSA-2026-1793873763 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.4-tuxcare.4.
- Record
CLSA-2026-1793873763- Updated
- 2026-11-05
OSVCLSA-2026-1793873891 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.2-tuxcare.4.
- Record
CLSA-2026-1793873891- Updated
- 2026-11-05
OSVCLSA-2026-1793874157 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.4-tuxcare.3.
- Record
CLSA-2026-1793874157- Updated
- 2026-11-05
OSVCLSA-2026-1793874356 No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.14.1-tuxcare.4.
- Record
CLSA-2026-1793874356- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:11279-1 No score
jackson-databind-2.18.9-2.1 on GA media
These are all security issues fixed in the jackson-databind-2.18.9-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11279-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21375-1 No score
Security update for jackson-annotations, jackson-core, jackson-databind
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
- honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
- Record
openSUSE-SU-2026:21375-1- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-59888 No score
CVE-2026-59888 in com.fasterxml.jackson.core:jackson-databind - Patched by Root
Root has patched CVE-2026-59888 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-59888- Updated
- 2026-11-02
OSVSUSE-SU-2026:22822-1 No score
Security update for jackson-annotations, jackson-core, jackson-databind
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
- honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
- Record
SUSE-SU-2026:22822-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3273-1 No score
Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-bom:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
- honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
Changes for jackson-dataformats-binary:
- Update to 2.18.9.
Changes for jackson-modules-base:
- Update to 2.18.9.
- Record
SUSE-SU-2026:3273-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.core:jackson-databindMaven |
2.15.0 up to 2.18.8 | 2.18.8 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.19.0 up to 2.21.4 | 2.21.4 |
tools.jackson.core:jackson-databindMaven |
3.0.0 up to 3.1.4 | 3.1.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.17.2 up to 2.17.2-tuxcare.1 | 2.17.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.17.3 up to 2.17.3-tuxcare.3, plus listed versions 2.17.3-tuxcare.12.17.3-tuxcare.2 |
2.17.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.17.1 up to 2.17.1-tuxcare.1 | 2.17.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs |
2.15.0 up to 2.15.0-tuxcare.1 | 2.15.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.15.4 up to 2.15.4-tuxcare.1 | 2.15.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.15.3 up to 2.15.3-tuxcare.1 | 2.15.3-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.15.2 up to 2.15.2-tuxcare.1 | 2.15.2-tuxcare.1 |
Show 63 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.18.5 up to 2.18.5-tuxcare.1 | 2.18.5-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.18.3 up to 2.18.3-tuxcare.1 | 2.18.3-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.18.0 up to 2.18.0-tuxcare.1 | 2.18.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.16.1 up to 2.16.1-tuxcare.1 | 2.16.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.19.2 up to 2.19.2-tuxcare.1 | 2.19.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.19.4 up to 2.19.4-tuxcare.1 | 2.19.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.19.0 up to 2.19.0-tuxcare.1 | 2.19.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.20.1 up to 2.20.1-tuxcare.1 | 2.20.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.16.0 up to 2.16.0-tuxcare.1 | 2.16.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.18.2 up to 2.18.2-tuxcare.1 | 2.18.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.18.4 up to 2.18.4-tuxcare.1 | 2.18.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.17.0 up to 2.17.0-tuxcare.1 | 2.17.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.16.2 up to 2.16.2-tuxcare.1 | 2.16.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs |
2.15.1 up to 2.15.1-tuxcare.1 | 2.15.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs |
2.21.2 up to 2.21.2-tuxcare.1 | 2.21.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.12.6.1 up to 2.12.6.1-tuxcare.4, plus listed versions 2.12.6.1-tuxcare.12.12.6.1-tuxcare.22.12.6.1-tuxcare.3 |
2.12.6.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.12.7.1 up to 2.12.7.1-tuxcare.5, plus listed versions 2.12.7.1-tuxcare.12.12.7.1-tuxcare.22.12.7.1-tuxcare.32.12.7.1-tuxcare.4 |
2.12.7.1-tuxcare.5 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs |
2.14.3 up to 2.14.3-tuxcare.2, plus listed versions 2.14.3-tuxcare.1 |
2.14.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.13.1 up to 2.13.1-tuxcare.4, plus listed versions 2.13.1-tuxcare.12.13.1-tuxcare.22.13.1-tuxcare.3 |
2.13.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
2.12.6 up to 2.12.6-tuxcare.3, plus listed versions 2.12.6-tuxcare.12.12.6-tuxcare.2 |
2.12.6-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs |
2.12.5 up to 2.12.5-tuxcare.4, plus listed versions 2.12.5-tuxcare.12.12.5-tuxcare.22.12.5-tuxcare.3 |
2.12.5-tuxcare.4 |
tools.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs |
3.1.2 up to 3.1.2-tuxcare.4, plus listed versions 3.1.2-tuxcare.13.1.2-tuxcare.23.1.2-tuxcare.3 |
3.1.2-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.12.7 up to 2.12.7-tuxcare.5, plus listed versions 2.12.7-tuxcare.12.12.7-tuxcare.22.12.7-tuxcare.32.12.7-tuxcare.4 |
2.12.7-tuxcare.5 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.14.2 up to 2.14.2-tuxcare.6, plus listed versions 2.14.2-tuxcare.12.14.2-tuxcare.22.14.2-tuxcare.32.14.2-tuxcare.42.14.2-tuxcare.5 |
2.14.2-tuxcare.6 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.12.1 up to 2.12.1-tuxcare.4, plus listed versions 2.12.1-tuxcare.12.12.1-tuxcare.22.12.1-tuxcare.3 |
2.12.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.13.5 up to 2.13.5-tuxcare.4, plus listed versions 2.13.5-tuxcare.12.13.5-tuxcare.22.13.5-tuxcare.3 |
2.13.5-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.13.4.2 up to 2.13.4.2-tuxcare.4, plus listed versions 2.13.4.2-tuxcare.12.13.4.2-tuxcare.22.13.4.2-tuxcare.3 |
2.13.4.2-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.13.3 up to 2.13.3-tuxcare.3, plus listed versions 2.13.3-tuxcare.12.13.3-tuxcare.2 |
2.13.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.12.4 up to 2.12.4-tuxcare.4, plus listed versions 2.12.4-tuxcare.12.12.4-tuxcare.22.12.4-tuxcare.3 |
2.12.4-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.12.2 up to 2.12.2-tuxcare.4, plus listed versions 2.12.2-tuxcare.12.12.2-tuxcare.22.12.2-tuxcare.3 |
2.12.2-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.13.4 up to 2.13.4-tuxcare.3, plus listed versions 2.13.4-tuxcare.12.13.4-tuxcare.2 |
2.13.4-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven |
2.14.1 up to 2.14.1-tuxcare.4, plus listed versions 2.14.1-tuxcare.12.14.1-tuxcare.22.14.1-tuxcare.3 |
2.14.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.15.0 up to 2.18.8, plus listed versions 2.15.12.15.22.15.32.15.42.16.0 Show 17 moreShow less2.16.0-rc12.16.12.16.22.17.02.17.0-rc12.17.12.17.22.17.32.18.02.18.0-rc12.18.12.18.22.18.32.18.42.18.52.18.62.18.7 |
2.18.8 |
com.fasterxml.jackson.core:jackson-databindMaven |
2.19.0 up to 2.21.4, plus listed versions 2.19.12.19.22.19.32.19.42.20.0 Show 7 moreShow less2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.3 |
2.21.4 |
tools.jackson.core:jackson-databindMaven |
3.0.0 up to 3.1.4, plus listed versions 3.0.13.0.23.0.33.0.43.1.0 Show 4 moreShow less3.1.0-rc13.1.13.1.23.1.3 |
3.1.4 |
com.fasterxml.jackson.core:jackson-databindRed Hat Lightwell:Maven From an advisory covering 8 CVEs |
before 2.17.3.rhlw-00013, plus listed versions 2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1 Show 45 moreShow less2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1 |
2.17.3.rhlw-00013 |
com.fasterxml.jackson.core:jackson-databindRed Hat Lightwell:Maven From an advisory covering 7 CVEs |
before 2.18.0.rhlw-00010, plus listed versions 2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1 Show 45 moreShow less2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1 |
2.18.0.rhlw-00010 |
com.fasterxml.jackson.core:jackson-databindRoot:Maven |
before 2.18.8-aikido.1 | 2.18.8-aikido.12.21.4-aikido.12.21.4-aikido.22.18.8-aikido.2 |
tools.jackson.core:jackson-databindRoot:Maven |
before 3.1.4-aikido.2 | 3.1.4-aikido.23.1.4-aikido.33.1.4-aikido.4 |
io.root.com.fasterxml.jackson.core:jackson-databindRoot:Maven |
before 2.18.8-root.io.1 | 2.18.8-root.io.12.21.4-root.io.12.21.4-root.io.22.18.8-root.io.2 |
io.root.tools.jackson.core:jackson-databindRoot:Maven |
before 3.1.4-root.io.2 | 3.1.4-root.io.23.1.4-root.io.33.1.4-root.io.4 |
jackson-annotationsSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs |
before 2.18.9-150200.3.25.1 | 2.18.9-150200.3.25.1 |
jackson-coreSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs |
before 2.18.9-150200.3.25.1 | 2.18.9-150200.3.25.1 |
jackson-databindSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs |
before 2.18.9-150200.3.33.1 | 2.18.9-150200.3.33.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 3 CVEs |
before 2.18.9-150200.3.24.1 | 2.18.9-150200.3.24.1 |
jackson-databindUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 2.2.2-12.2.2-1ubuntu0.1~esm1 |
None known |
jackson-databindUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.4.2-22.4.2-32.4.2-3ubuntu0.1~esm12.4.2-3ubuntu0.1~esm2 |
None known |
jackson-databindUbuntu:18.04:LTS |
All versions, plus listed versions 2.8.6-12.9.1-12.9.4-12.9.5-12.9.8-1~18.04 |
None known |
jackson-databindUbuntu:20.04:LTS |
All versions, plus listed versions 2.9.9.3-12.10.0-22.10.1-12.10.2-1 |
None known |
jackson-databindUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.1-12.12.5-12.13.0-12.13.0-2 |
None known |
jackson-databindUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.0-1 |
None known |
jackson-databindUbuntu:26.10 |
All versions, plus listed versions 2.14.0+ds-1build12.14.0+ds-2 |
None known |
jackson-databindUbuntu:26.04:LTS |
All versions, plus listed versions 2.14.0+ds-12.14.0+ds-1build1 |
None known |
jackson-databindopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.18.9-2.1 | 2.18.9-2.1 |
jackson-annotationsopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-coreopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-databindopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-59888 is a medium vulnerability (CVSS 6.5) in Fasterxml Jackson-databind, published July 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in com.fasterxml.jackson.core:jackson-databind 2.18.8.
References
github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5
nvd.nist.gov/vuln/detail/CVE-2026-59888
Show 92 moreShow less
repo.maven.apache.org/maven2
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json
access.redhat.com/errata/RHSA-2026:36839
suse.com/support/update/announcement/2026/suse-su-202622822-1
bugzilla.suse.com/1268902
ubuntu.com/security/CVE-2026-59888
cve.org/CVERecord?id=CVE-2026-59888
Left out here: 302 versions. The JSON record has them.