CVE-2026-59888
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
CVE-2026-59888 is a medium vulnerability (CVSS 6.5) in Fasterxml Jackson-databind, published July 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 37th percentile. Fixed in com.fasterxml.jackson.core:jackson-databind 2.18.8.
- Severity
- 6.5 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.42%EPSS, 37th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.18.8com.fasterxml.jackson.core:jackson-databind +69 more
Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.core:jackson-databindMaven | 2.15.0 up to 2.18.8 | 2.18.8 |
com.fasterxml.jackson.core:jackson-databindMaven | 2.19.0 up to 2.21.4 | 2.21.4 |
tools.jackson.core:jackson-databindMaven | 3.0.0 up to 3.1.4 | 3.1.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs | 2.17.2 up to 2.17.2-tuxcare.1 | 2.17.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs | 2.17.3 up to 2.17.3-tuxcare.3, plus listed versions 2.17.3-tuxcare.12.17.3-tuxcare.2 | 2.17.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.17.1 up to 2.17.1-tuxcare.1 | 2.17.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 8 CVEs | 2.15.0 up to 2.15.0-tuxcare.1 | 2.15.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.15.4 up to 2.15.4-tuxcare.1 | 2.15.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.15.3 up to 2.15.3-tuxcare.1 | 2.15.3-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.15.2 up to 2.15.2-tuxcare.1 | 2.15.2-tuxcare.1 |
Show 60 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs | 2.18.5 up to 2.18.5-tuxcare.1 | 2.18.5-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.18.3 up to 2.18.3-tuxcare.1 | 2.18.3-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.18.0 up to 2.18.0-tuxcare.1 | 2.18.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.16.1 up to 2.16.1-tuxcare.1 | 2.16.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.19.2 up to 2.19.2-tuxcare.1 | 2.19.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.19.4 up to 2.19.4-tuxcare.1 | 2.19.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.19.0 up to 2.19.0-tuxcare.1 | 2.19.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs | 2.20.1 up to 2.20.1-tuxcare.1 | 2.20.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs | 2.16.0 up to 2.16.0-tuxcare.1 | 2.16.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.18.2 up to 2.18.2-tuxcare.1 | 2.18.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.18.4 up to 2.18.4-tuxcare.1 | 2.18.4-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.17.0 up to 2.17.0-tuxcare.1 | 2.17.0-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs | 2.16.2 up to 2.16.2-tuxcare.1 | 2.16.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 6 CVEs | 2.15.1 up to 2.15.1-tuxcare.1 | 2.15.1-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 7 CVEs | 2.21.2 up to 2.21.2-tuxcare.1 | 2.21.2-tuxcare.1 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.12.6.1 up to 2.12.6.1-tuxcare.4, plus listed versions 2.12.6.1-tuxcare.12.12.6.1-tuxcare.22.12.6.1-tuxcare.3 | 2.12.6.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.12.7.1 up to 2.12.7.1-tuxcare.5, plus listed versions 2.12.7.1-tuxcare.12.12.7.1-tuxcare.22.12.7.1-tuxcare.32.12.7.1-tuxcare.4 | 2.12.7.1-tuxcare.5 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 5 CVEs | 2.14.3 up to 2.14.3-tuxcare.2, plus listed versions 2.14.3-tuxcare.1 | 2.14.3-tuxcare.2 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.13.1 up to 2.13.1-tuxcare.4, plus listed versions 2.13.1-tuxcare.12.13.1-tuxcare.22.13.1-tuxcare.3 | 2.13.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 2.12.6 up to 2.12.6-tuxcare.3, plus listed versions 2.12.6-tuxcare.12.12.6-tuxcare.2 | 2.12.6-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 3 CVEs | 2.12.5 up to 2.12.5-tuxcare.4, plus listed versions 2.12.5-tuxcare.12.12.5-tuxcare.22.12.5-tuxcare.3 | 2.12.5-tuxcare.4 |
tools.jackson.core:jackson-databindTuxCare:Maven From an advisory covering 2 CVEs | 3.1.2 up to 3.1.2-tuxcare.4, plus listed versions 3.1.2-tuxcare.13.1.2-tuxcare.23.1.2-tuxcare.3 | 3.1.2-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.12.7 up to 2.12.7-tuxcare.5, plus listed versions 2.12.7-tuxcare.12.12.7-tuxcare.22.12.7-tuxcare.32.12.7-tuxcare.4 | 2.12.7-tuxcare.5 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.14.2 up to 2.14.2-tuxcare.6, plus listed versions 2.14.2-tuxcare.12.14.2-tuxcare.22.14.2-tuxcare.32.14.2-tuxcare.42.14.2-tuxcare.5 | 2.14.2-tuxcare.6 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.12.1 up to 2.12.1-tuxcare.4, plus listed versions 2.12.1-tuxcare.12.12.1-tuxcare.22.12.1-tuxcare.3 | 2.12.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.13.5 up to 2.13.5-tuxcare.4, plus listed versions 2.13.5-tuxcare.12.13.5-tuxcare.22.13.5-tuxcare.3 | 2.13.5-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.13.4.2 up to 2.13.4.2-tuxcare.4, plus listed versions 2.13.4.2-tuxcare.12.13.4.2-tuxcare.22.13.4.2-tuxcare.3 | 2.13.4.2-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.13.3 up to 2.13.3-tuxcare.3, plus listed versions 2.13.3-tuxcare.12.13.3-tuxcare.2 | 2.13.3-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.12.4 up to 2.12.4-tuxcare.4, plus listed versions 2.12.4-tuxcare.12.12.4-tuxcare.22.12.4-tuxcare.3 | 2.12.4-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.12.2 up to 2.12.2-tuxcare.4, plus listed versions 2.12.2-tuxcare.12.12.2-tuxcare.22.12.2-tuxcare.3 | 2.12.2-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.13.4 up to 2.13.4-tuxcare.3, plus listed versions 2.13.4-tuxcare.12.13.4-tuxcare.2 | 2.13.4-tuxcare.3 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.14.1 up to 2.14.1-tuxcare.4, plus listed versions 2.14.1-tuxcare.12.14.1-tuxcare.22.14.1-tuxcare.3 | 2.14.1-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindTuxCare:Maven | 2.13.0 up to 2.13.0-tuxcare.4, plus listed versions 2.13.0-tuxcare.12.13.0-tuxcare.22.13.0-tuxcare.3 | 2.13.0-tuxcare.4 |
com.fasterxml.jackson.core:jackson-databindMaven | 2.15.0 up to 2.18.8, plus listed versions 2.15.12.15.22.15.32.15.42.16.0 Show 17 moreShow less2.16.0-rc12.16.12.16.22.17.02.17.0-rc12.17.12.17.22.17.32.18.02.18.0-rc12.18.12.18.22.18.32.18.42.18.52.18.62.18.7 | 2.18.8 |
com.fasterxml.jackson.core:jackson-databindMaven | 2.19.0 up to 2.21.4, plus listed versions 2.19.12.19.22.19.32.19.42.20.0 Show 7 moreShow less2.20.0-rc12.20.12.20.22.21.02.21.12.21.22.21.3 | 2.21.4 |
tools.jackson.core:jackson-databindMaven | 3.0.0 up to 3.1.4, plus listed versions 3.0.13.0.23.0.33.0.43.1.0 Show 4 moreShow less3.1.0-rc13.1.13.1.23.1.3 | 3.1.4 |
com.fasterxml.jackson.core:jackson-databindRed Hat Lightwell:Maven From an advisory covering 8 CVEs | before 2.17.3.rhlw-00013, plus listed versions 2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1 Show 45 moreShow less2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1 | 2.17.3.rhlw-00013 |
com.fasterxml.jackson.core:jackson-databindRed Hat Lightwell:Maven From an advisory covering 7 CVEs | before 2.18.0.rhlw-00010, plus listed versions 2.0.02.0.0-RC12.0.0-RC22.0.0-RC32.0.1 Show 45 moreShow less2.0.22.0.42.0.52.0.62.1.02.1.12.1.22.1.32.1.42.1.52.10.02.10.0.pr12.10.0.pr22.10.0.pr32.10.12.10.22.10.32.10.42.10.52.10.5.12.11.02.11.0.rc12.11.12.11.22.11.32.11.42.12.02.12.0-rc12.12.0-rc22.12.12.12.22.12.32.12.42.12.52.12.62.12.6.12.12.72.12.7.12.12.7.22.13.02.13.0-rc12.13.0-rc22.13.12.13.22.13.2.1 | 2.18.0.rhlw-00010 |
jackson-annotationsSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-coreSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-databindSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-annotationsSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs | before 2.18.9-150200.3.25.1 | 2.18.9-150200.3.25.1 |
jackson-coreSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs | before 2.18.9-150200.3.25.1 | 2.18.9-150200.3.25.1 |
jackson-databindSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 3 CVEs | before 2.18.9-150200.3.33.1 | 2.18.9-150200.3.33.1 |
jackson-dataformats-binarySUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 3 CVEs | before 2.18.9-150200.3.24.1 | 2.18.9-150200.3.24.1 |
jackson-databindUbuntu:Pro:14.04:LTS | All versions, plus listed versions 2.2.2-12.2.2-1ubuntu0.1~esm1 | None known |
jackson-databindUbuntu:Pro:16.04:LTS | All versions, plus listed versions 2.4.2-22.4.2-32.4.2-3ubuntu0.1~esm12.4.2-3ubuntu0.1~esm2 | None known |
jackson-databindUbuntu:18.04:LTS | All versions, plus listed versions 2.8.6-12.9.1-12.9.4-12.9.5-12.9.8-1~18.04 | None known |
jackson-databindUbuntu:20.04:LTS | All versions, plus listed versions 2.9.9.3-12.10.0-22.10.1-12.10.2-1 | None known |
jackson-databindUbuntu:22.04:LTS | All versions, plus listed versions 2.12.1-12.12.5-12.13.0-12.13.0-2 | None known |
jackson-databindUbuntu:24.04:LTS | All versions, plus listed versions 2.14.0-1 | None known |
jackson-databindUbuntu:26.10 | All versions, plus listed versions 2.14.0+ds-1build12.14.0+ds-2 | None known |
jackson-databindUbuntu:26.04:LTS | All versions, plus listed versions 2.14.0+ds-12.14.0+ds-1build1 | None known |
jackson-databindopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 2.18.9-2.1 | 2.18.9-2.1 |
jackson-annotationsopenSUSE:Leap 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-coreopenSUSE:Leap 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
jackson-databindopenSUSE:Leap 16.0 From an advisory covering 3 CVEs | before 2.18.9-160000.1.1 | 2.18.9-160000.1.1 |
What each source reports
CVE List Score used
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
EUVDEUVD-2026-43957
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
EUVD-2026-43957- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3pjw-73gf-8qr5
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Summary
For Java Records, POJOPropertiesCollector._removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before _renameUsing() applies the PropertyNamingStrategy. After the rename, _ignoredPropertyNames still holds only the pre-rename name, so _ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.
Impact
A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).
Affected / Patched (verified via git tag --contains)
- 2.15-2.18 line:
>= 2.15.0, < 2.18.8-> fixed in 2.18.8 (backportc7c6783) - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4 (#5974,baa2cdf)
Severity / CWE
Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
- Record
GHSA-3pjw-73gf-8qr5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
NVD
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
OSV
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
OSVGHSA-3pjw-73gf-8qr5
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Summary
For Java Records, POJOPropertiesCollector._removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before _renameUsing() applies the PropertyNamingStrategy. After the rename, _ignoredPropertyNames still holds only the pre-rename name, so _ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.
Impact
A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).
Affected / Patched (verified via git tag --contains)
- 2.15-2.18 line:
>= 2.15.0, < 2.18.8-> fixed in 2.18.8 (backportc7c6783) - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4 (#5974,baa2cdf)
Severity / CWE
Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
- Record
GHSA-3pjw-73gf-8qr5- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-915
- Updated
- 2026-11-02
Show 47 moreShow less
OSVRHLW-2026-09128b29f89dc8ed
Lightwell Security Advisory: jackson-databind 2.17.3.rhlw-00013
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.17.3.rhlw-00013 with backported fixes for CVE-2026-83557, CVE-2026-54512, CVE-2026-54515, CVE-2026-19032, CVE-2026-77310, CVE-2026-54514, CVE-2026-59888, and CVE-2026-54513.
CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
CVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation
CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
CVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)
CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.17.3 from Maven Central.
- Record
RHLW-2026-09128b29f89dc8ed- CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHLW-2026-804d65df1a73952a
Lightwell Security Advisory: jackson-databind 2.18.0.rhlw-00010
Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.18.0.rhlw-00010 with backported fixes for CVE-2026-19032, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, and CVE-2026-83557.
CVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path
CVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)
CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)
CVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
CVE-2026-59889: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
CVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
This patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.18.0 from Maven Central.
- Record
RHLW-2026-804d65df1a73952a- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-59888
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
- Record
UBUNTU-CVE-2026-59888- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1789494210No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1.
- Record
CLSA-2026-1789494210- Updated
- 2026-11-02
OSVCLSA-2026-1791487635No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.3-tuxcare.3.
- Record
CLSA-2026-1791487635- Updated
- 2026-11-02
OSVCLSA-2026-1791545828No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.
- Record
CLSA-2026-1791545828- Updated
- 2026-11-02
OSVCLSA-2026-1792441007No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.15.0-tuxcare.1.
- Record
CLSA-2026-1792441007- Updated
- 2026-11-02
OSVCLSA-2026-1792441426No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.4-tuxcare.1.
- Record
CLSA-2026-1792441426- Updated
- 2026-11-02
OSVCLSA-2026-1792441448No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.3-tuxcare.1.
- Record
CLSA-2026-1792441448- Updated
- 2026-11-02
OSVCLSA-2026-1792441664No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.2-tuxcare.1.
- Record
CLSA-2026-1792441664- Updated
- 2026-11-02
OSVCLSA-2026-1792441755No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.18.5-tuxcare.1.
- Record
CLSA-2026-1792441755- Updated
- 2026-11-02
OSVCLSA-2026-1792441929No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.3-tuxcare.1.
- Record
CLSA-2026-1792441929- Updated
- 2026-11-02
OSVCLSA-2026-1792442035No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.0-tuxcare.1.
- Record
CLSA-2026-1792442035- Updated
- 2026-11-02
OSVCLSA-2026-1792475167No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.
- Record
CLSA-2026-1792475167- Updated
- 2026-11-02
OSVCLSA-2026-1792479593No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.2-tuxcare.1.
- Record
CLSA-2026-1792479593- Updated
- 2026-11-02
OSVCLSA-2026-1792479645No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.4-tuxcare.1.
- Record
CLSA-2026-1792479645- Updated
- 2026-11-02
OSVCLSA-2026-1792479649No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.0-tuxcare.1.
- Record
CLSA-2026-1792479649- Updated
- 2026-11-02
OSVCLSA-2026-1792479685No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.20.1-tuxcare.1.
- Record
CLSA-2026-1792479685- Updated
- 2026-11-02
OSVCLSA-2026-1792516705No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.16.0-tuxcare.1.
- Record
CLSA-2026-1792516705- Updated
- 2026-11-02
OSVCLSA-2026-1792516904No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.2-tuxcare.1.
- Record
CLSA-2026-1792516904- Updated
- 2026-11-02
OSVCLSA-2026-1792516966No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.4-tuxcare.1.
- Record
CLSA-2026-1792516966- Updated
- 2026-11-02
OSVCLSA-2026-1792517919No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.0-tuxcare.1.
- Record
CLSA-2026-1792517919- Updated
- 2026-11-02
OSVCLSA-2026-1792517950No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.16.2-tuxcare.1.
- Record
CLSA-2026-1792517950- Updated
- 2026-11-02
OSVCLSA-2026-1792517982No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.1-tuxcare.1.
- Record
CLSA-2026-1792517982- Updated
- 2026-11-02
OSVCLSA-2026-1793201235No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.21.2-tuxcare.1.
- Record
CLSA-2026-1793201235- Updated
- 2026-11-02
OSVCLSA-2026-1793869125No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.6.1-tuxcare.4.
- Record
CLSA-2026-1793869125- Updated
- 2026-11-05
OSVCLSA-2026-1793869236No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.7.1-tuxcare.5.
- Record
CLSA-2026-1793869236- Updated
- 2026-11-05
OSVCLSA-2026-1793869689No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.3-tuxcare.2.
- Record
CLSA-2026-1793869689- Updated
- 2026-11-05
OSVCLSA-2026-1793870483No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.13.1-tuxcare.4.
- Record
CLSA-2026-1793870483- Updated
- 2026-11-05
OSVCLSA-2026-1793871662No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.6-tuxcare.3.
- Record
CLSA-2026-1793871662- Updated
- 2026-11-05
OSVCLSA-2026-1793871768No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.12.5-tuxcare.4.
- Record
CLSA-2026-1793871768- Updated
- 2026-11-05
OSVCLSA-2026-1793871871No score
TuxCare security update for tools.jackson.core:jackson-databind (2 CVEs)
TuxCare rebuilt tools.jackson.core:jackson-databind to address 2 CVEs. Fixed in 3.1.2-tuxcare.4.
- Record
CLSA-2026-1793871871- Updated
- 2026-11-05
OSVCLSA-2026-1793872442No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.7-tuxcare.5.
- Record
CLSA-2026-1793872442- Updated
- 2026-11-05
OSVCLSA-2026-1793872782No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.14.2-tuxcare.6.
- Record
CLSA-2026-1793872782- Updated
- 2026-11-05
OSVCLSA-2026-1793873198No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.1-tuxcare.4.
- Record
CLSA-2026-1793873198- Updated
- 2026-11-05
OSVCLSA-2026-1793873326No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.5-tuxcare.4.
- Record
CLSA-2026-1793873326- Updated
- 2026-11-05
OSVCLSA-2026-1793873445No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.4.2-tuxcare.4.
- Record
CLSA-2026-1793873445- Updated
- 2026-11-05
OSVCLSA-2026-1793873541No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.3-tuxcare.3.
- Record
CLSA-2026-1793873541- Updated
- 2026-11-05
OSVCLSA-2026-1793873763No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.4-tuxcare.4.
- Record
CLSA-2026-1793873763- Updated
- 2026-11-05
OSVCLSA-2026-1793873891No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.2-tuxcare.4.
- Record
CLSA-2026-1793873891- Updated
- 2026-11-05
OSVCLSA-2026-1793874157No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.4-tuxcare.3.
- Record
CLSA-2026-1793874157- Updated
- 2026-11-05
OSVCLSA-2026-1793874356No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.14.1-tuxcare.4.
- Record
CLSA-2026-1793874356- Updated
- 2026-11-05
OSVCLSA-2026-1794231263No score
TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)
TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.0-tuxcare.4.
- Record
CLSA-2026-1794231263- Updated
- 2026-11-09
OSVopenSUSE-SU-2026:11279-1No score
jackson-databind-2.18.9-2.1 on GA media
These are all security issues fixed in the jackson-databind-2.18.9-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11279-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21375-1No score
Security update for jackson-annotations, jackson-core, jackson-databind
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
- honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
- Record
openSUSE-SU-2026:21375-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22822-1No score
Security update for jackson-annotations, jackson-core, jackson-databind
This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
- honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
- Record
SUSE-SU-2026:22822-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3273-1No score
Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to @JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of @JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-bom:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
- honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
Changes for jackson-dataformats-binary:
- Update to 2.18.9.
Changes for jackson-modules-base:
- Update to 2.18.9.
- Record
SUSE-SU-2026:3273-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | ||
| aliases | ||
| affected, aliases | OSV | |
| affected | ||
| affected, aliases, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5
nvd.nist.gov/vuln/detail/CVE-2026-59888
Show 92 moreShow less
repo.maven.apache.org/maven2
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json
access.redhat.com/errata/RHSA-2026:36839
suse.com/support/update/announcement/2026/suse-su-202622822-1
bugzilla.suse.com/1268902
ubuntu.com/security/CVE-2026-59888
cve.org/CVERecord?id=CVE-2026-59888
Left out here: 302 versions. The JSON record has them.