{"id":"CVE-2026-59888","aliases":["CLSA-2026-1789494210","CLSA-2026-1791487635","CLSA-2026-1791545828","CLSA-2026-1792441007","CLSA-2026-1792441426","CLSA-2026-1792441448","CLSA-2026-1792441664","CLSA-2026-1792441755","CLSA-2026-1792441929","CLSA-2026-1792442035","CLSA-2026-1792475167","CLSA-2026-1792479593","CLSA-2026-1792479645","CLSA-2026-1792479649","CLSA-2026-1792479685","CLSA-2026-1792516705","CLSA-2026-1792516904","CLSA-2026-1792516966","CLSA-2026-1792517919","CLSA-2026-1792517950","CLSA-2026-1792517982","CLSA-2026-1793201235","CLSA-2026-1793869125","CLSA-2026-1793869236","CLSA-2026-1793869689","CLSA-2026-1793870483","CLSA-2026-1793871662","CLSA-2026-1793871768","CLSA-2026-1793871871","CLSA-2026-1793872442","CLSA-2026-1793872782","CLSA-2026-1793873198","CLSA-2026-1793873326","CLSA-2026-1793873445","CLSA-2026-1793873541","CLSA-2026-1793873763","CLSA-2026-1793873891","CLSA-2026-1793874157","CLSA-2026-1793874356","CLSA-2026-1794231263","EUVD-2026-43957","GHSA-3pjw-73gf-8qr5","RHLW-2026-09128b29f89dc8ed","RHLW-2026-804d65df1a73952a","SUSE-SU-2026:22822-1","SUSE-SU-2026:3273-1","UBUNTU-CVE-2026-59888","openSUSE-SU-2026:11279-1","openSUSE-SU-2026:21375-1"],"status":"published","title":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00423,"percentile":0.3708,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-915"],"published":"2026-07-14T16:44:20Z","modified":"2026-11-09T19:15:06Z","fixes":[{"ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.18.8","2.21.4"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","fixed_in":["3.1.4"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","fixed_in":["2.12.7-tuxcare.5","2.14.2-tuxcare.6","2.12.1-tuxcare.4","2.13.5-tuxcare.4","2.13.4.2-tuxcare.4","2.13.3-tuxcare.3","2.12.4-tuxcare.4","2.12.2-tuxcare.4","2.13.4-tuxcare.3","2.14.1-tuxcare.4","2.13.0-tuxcare.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.18.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.1"}]}],"versions":["2.17.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.3"},{"fixed":"2.17.3-tuxcare.3"}]}],"versions":["2.17.3","2.17.3-tuxcare.1","2.17.3-tuxcare.2"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.1"}]}],"versions":["2.17.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.15.0-tuxcare.1"}]}],"versions":["2.15.0"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.4"},{"fixed":"2.15.4-tuxcare.1"}]}],"versions":["2.15.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.3"},{"fixed":"2.15.3-tuxcare.1"}]}],"versions":["2.15.3"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.2"},{"fixed":"2.15.2-tuxcare.1"}]}],"versions":["2.15.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.5"},{"fixed":"2.18.5-tuxcare.1"}]}],"versions":["2.18.5"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.3"},{"fixed":"2.18.3-tuxcare.1"}]}],"versions":["2.18.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.18.0-tuxcare.1"}]}],"versions":["2.18.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.1"},{"fixed":"2.16.1-tuxcare.1"}]}],"versions":["2.16.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.2"},{"fixed":"2.19.2-tuxcare.1"}]}],"versions":["2.19.2"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.4"},{"fixed":"2.19.4-tuxcare.1"}]}],"versions":["2.19.4"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.1"}]}],"versions":["2.19.0"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.1"},{"fixed":"2.20.1-tuxcare.1"}]}],"versions":["2.20.1"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.0"},{"fixed":"2.16.0-tuxcare.1"}]}],"versions":["2.16.0"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.2"},{"fixed":"2.18.2-tuxcare.1"}]}],"versions":["2.18.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.4"},{"fixed":"2.18.4-tuxcare.1"}]}],"versions":["2.18.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.0"},{"fixed":"2.17.0-tuxcare.1"}]}],"versions":["2.17.0"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.16.2"},{"fixed":"2.16.2-tuxcare.1"}]}],"versions":["2.16.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.1"},{"fixed":"2.15.1-tuxcare.1"}]}],"versions":["2.15.1"],"bundled":6},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.2"},{"fixed":"2.21.2-tuxcare.1"}]}],"versions":["2.21.2"],"bundled":7},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6.1"},{"fixed":"2.12.6.1-tuxcare.4"}]}],"versions":["2.12.6.1","2.12.6.1-tuxcare.1","2.12.6.1-tuxcare.2","2.12.6.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7.1"},{"fixed":"2.12.7.1-tuxcare.5"}]}],"versions":["2.12.7.1","2.12.7.1-tuxcare.1","2.12.7.1-tuxcare.2","2.12.7.1-tuxcare.3","2.12.7.1-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.3"},{"fixed":"2.14.3-tuxcare.2"}]}],"versions":["2.14.3","2.14.3-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.1"},{"fixed":"2.13.1-tuxcare.4"}]}],"versions":["2.13.1","2.13.1-tuxcare.1","2.13.1-tuxcare.2","2.13.1-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.6"},{"fixed":"2.12.6-tuxcare.3"}]}],"versions":["2.12.6","2.12.6-tuxcare.1","2.12.6-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.5"},{"fixed":"2.12.5-tuxcare.4"}]}],"versions":["2.12.5","2.12.5-tuxcare.1","2.12.5-tuxcare.2","2.12.5-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.1.2"},{"fixed":"3.1.2-tuxcare.4"}]}],"versions":["3.1.2","3.1.2-tuxcare.1","3.1.2-tuxcare.2","3.1.2-tuxcare.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.7"},{"fixed":"2.12.7-tuxcare.5"}]}],"versions":["2.12.7","2.12.7-tuxcare.1","2.12.7-tuxcare.2","2.12.7-tuxcare.3","2.12.7-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.2"},{"fixed":"2.14.2-tuxcare.6"}]}],"versions":["2.14.2","2.14.2-tuxcare.1","2.14.2-tuxcare.2","2.14.2-tuxcare.3","2.14.2-tuxcare.4","2.14.2-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.1"},{"fixed":"2.12.1-tuxcare.4"}]}],"versions":["2.12.1","2.12.1-tuxcare.1","2.12.1-tuxcare.2","2.12.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.5"},{"fixed":"2.13.5-tuxcare.4"}]}],"versions":["2.13.5","2.13.5-tuxcare.1","2.13.5-tuxcare.2","2.13.5-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4.2"},{"fixed":"2.13.4.2-tuxcare.4"}]}],"versions":["2.13.4.2","2.13.4.2-tuxcare.1","2.13.4.2-tuxcare.2","2.13.4.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.3"}]}],"versions":["2.13.3","2.13.3-tuxcare.1","2.13.3-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.4"},{"fixed":"2.12.4-tuxcare.4"}]}],"versions":["2.12.4","2.12.4-tuxcare.1","2.12.4-tuxcare.2","2.12.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.12.2"},{"fixed":"2.12.2-tuxcare.4"}]}],"versions":["2.12.2","2.12.2-tuxcare.1","2.12.2-tuxcare.2","2.12.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.4"},{"fixed":"2.13.4-tuxcare.3"}]}],"versions":["2.13.4","2.13.4-tuxcare.1","2.13.4-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.14.1"},{"fixed":"2.14.1-tuxcare.4"}]}],"versions":["2.14.1","2.14.1-tuxcare.1","2.14.1-tuxcare.2","2.14.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.13.0-tuxcare.4"}]}],"versions":["2.13.0","2.13.0-tuxcare.1","2.13.0-tuxcare.2","2.13.0-tuxcare.3"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.15.0"},{"fixed":"2.18.8"}]}],"versions":["2.15.0","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.18.1","2.18.2","2.18.3","2.18.4","2.18.5","2.18.6","2.18.7"]},{"source":"osv","ecosystem":"Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.4"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3"]},{"source":"osv","ecosystem":"Maven","package":"tools.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.4"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.3.rhlw-00013"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.10.4","2.9.10.5","2.9.10.6","2.9.10.7","2.9.10.8","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"],"bundled":8},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"com.fasterxml.jackson.core:jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.0.rhlw-00010"}]}],"versions":["2.0.0","2.0.0-RC1","2.0.0-RC2","2.0.0-RC3","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1","2.15.0-rc2","2.15.0-rc3","2.15.1","2.15.2","2.15.3","2.15.4","2.16.0","2.16.0-rc1","2.16.1","2.16.2","2.17.0","2.17.0-rc1","2.17.1","2.17.2","2.17.3","2.18.0","2.18.0-rc1","2.2.0","2.2.0-rc1","2.2.1","2.2.2","2.2.3","2.2.4","2.3.0","2.3.0-rc1","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.4.0","2.4.0-rc1","2.4.0-rc2","2.4.0-rc3","2.4.1","2.4.1.1","2.4.1.2","2.4.1.3","2.4.2","2.4.3","2.4.4","2.4.5","2.4.5.1","2.4.6","2.4.6.1","2.5.0","2.5.0-rc1","2.5.1","2.5.2","2.5.3","2.5.4","2.5.5","2.6.0","2.6.0-rc1","2.6.0-rc2","2.6.0-rc3","2.6.0-rc4","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.7.1","2.6.7.2","2.6.7.3","2.6.7.4","2.6.7.5","2.7.0","2.7.0-rc1","2.7.0-rc2","2.7.0-rc3","2.7.1","2.7.1-1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7","2.7.8","2.7.9","2.7.9.1","2.7.9.2","2.7.9.3","2.7.9.4","2.7.9.5","2.7.9.6","2.7.9.7","2.8.0","2.8.0.rc1","2.8.0.rc2","2.8.1","2.8.10","2.8.11","2.8.11.1","2.8.11.2","2.8.11.3","2.8.11.4","2.8.11.5","2.8.11.6","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","2.8.8","2.8.8.1","2.8.9","2.9.0","2.9.0.pr1","2.9.0.pr2","2.9.0.pr3","2.9.0.pr4","2.9.1","2.9.10","2.9.10.1","2.9.10.2","2.9.10.3","2.9.10.4","2.9.10.5","2.9.10.6","2.9.10.7","2.9.10.8","2.9.2","2.9.3","2.9.4","2.9.5","2.9.6","2.9.7","2.9.8","2.9.9","2.9.9.1","2.9.9.2","2.9.9.3"],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-150200.3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-150200.3.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-150200.3.33.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jackson-dataformats-binary","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-150200.3.24.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.2-1","2.2.2-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.2-2","2.4.2-3","2.4.2-3ubuntu0.1~esm1","2.4.2-3ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.6-1","2.9.1-1","2.9.4-1","2.9.5-1","2.9.8-1~18.04"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.9.3-1","2.10.0-2","2.10.1-1","2.10.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.1-1","2.12.5-1","2.13.0-1","2.13.0-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1build1","2.14.0+ds-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.0+ds-1","2.14.0+ds-1build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-2.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"jackson-databind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.9-160000.1.1"}]}],"bundled":3}],"products":[{"vendor":"fasterxml","product":"jackson-databind"}],"references":[{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5974","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59888","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3pjw-73gf-8qr5","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59888.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind","tags":["package"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83557.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-gx83-3vf8-gh7j","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83557","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/6156","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/eb3b7fc0f9c0d27f471550ac3316b17d1987388f","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6155","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-gx83-3vf8-gh7j","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54512.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-j3rv-43j4-c7qm","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54512","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5988","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/434d6c511de7fdd9872f29157aafb6162d12d8d5","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-j3rv-43j4-c7qm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54515.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5jmj-h7xm-6q6v","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54515","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5962","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5964","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/0e1b0b211f7a53baa62ba2f4c9bd006c7bf4d5fa","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5jmj-h7xm-6q6v","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19032.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wjgm-6hv5-3cvf","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19032","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/cc6756b61ed90b6b9227f670e0408d5d9bd48551","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/ce26eda3481cd796f76ba4c53ffe1da23b53f166","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/d94bb632becfe0ba96926b9909ab06d1f87aad6d","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6129","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-wjgm-6hv5-3cvf","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77310.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-vvgp-rfg2-7rr6","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77310","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vvgp-rfg2-7rr6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54514.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-hgj6-7826-r7m5","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54514","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/1f5a1037b1e9e05920e755cb35f198bcd46667e4","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5951","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-hgj6-7826-r7m5","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54513.json","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:36839","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:40895","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41951","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43218","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43400","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44061","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44062","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44063","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44064","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44065","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44066","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:44271","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48095","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:48151","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50846","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50847","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50848","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:50849","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54435","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:54622","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:62260","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66488","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:66545","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-54513","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54513.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rmj7-2vxq-3g9f","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54513","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5981","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/5983","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/24529da29fdf46ff94ca38de9ebf31cd188f5e8e","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/5984","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-rmj7-2vxq-3g9f","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-databind/issues/6060","tags":["report"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","tags":["fix"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6056","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622822-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1268902","tags":["report"]},{"url":"https://bugzilla.suse.com/1271440","tags":["report"]},{"url":"https://bugzilla.suse.com/1271442","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-54515","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-59889","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263273-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-59888","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59888","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-59888","title":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.","status":"published","published":"2026-07-14T16:44:20.091Z","modified":"2026-07-14T17:52:03.675Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:19:58.560602Z"}],"euvd":[{"id":"EUVD-2026-43957","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.","status":"published","published":"2026-07-14T16:44:20Z","modified":"2026-07-14T17:52:03Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:19:59.200665Z"}],"ghsa":[{"id":"GHSA-3pjw-73gf-8qr5","title":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy","description":"## Summary\nFor Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record's constructor parameter, defeating the `@JsonIgnore`.\n\n## Impact\nA Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.15-2.18 line: `\u003e= 2.15.0, \u003c 2.18.8` -\u003e fixed in **2.18.8** (backport `c7c6783`)\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5974, `baa2cdf`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","status":"published","published":"2026-07-21T19:33:06Z","modified":"2026-07-21T19:33:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:40:50.444681Z"}],"nvd":[{"id":"CVE-2026-59888","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.","status":"published","published":"2026-07-14T17:17:15.137Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T14:12:29.489525Z"}],"osv":[{"id":"CVE-2026-59888","title":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.","status":"published","published":"2026-07-14T16:44:20.091Z","modified":"2026-10-28T11:17:02.465327687Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:45:12.496548Z"},{"id":"GHSA-3pjw-73gf-8qr5","title":"jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy","description":"## Summary\nFor Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record's constructor parameter, defeating the `@JsonIgnore`.\n\n## Impact\nA Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.15-2.18 line: `\u003e= 2.15.0, \u003c 2.18.8` -\u003e fixed in **2.18.8** (backport `c7c6783`)\n- 2.19-2.21 line: `\u003e= 2.19.0, \u003c 2.21.4` -\u003e fixed in **2.21.4**\n- 3.x line: `\u003e= 3.0.0, \u003c 3.1.4` -\u003e fixed in **3.1.4** (#5974, `baa2cdf`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.","status":"published","published":"2026-07-21T19:33:06Z","modified":"2026-09-10T03:51:10.312389083Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-915"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"RHLW-2026-09128b29f89dc8ed","title":"Lightwell Security Advisory: jackson-databind 2.17.3.rhlw-00013","description":"Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.17.3.rhlw-00013 with backported fixes for CVE-2026-83557, CVE-2026-54512, CVE-2026-54515, CVE-2026-19032, CVE-2026-77310, CVE-2026-54514, CVE-2026-59888, and CVE-2026-54513.\n\nCVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types\n\nCVE-2026-54512: jackson-databind: PolymorphicTypeValidator bypass via generic type parameters allows arbitrary class instantiation\n\nCVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties\n\nCVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path\n\nCVE-2026-77310: jackson-databind: Eager DNS resolution (SSRF) still present in InetAddress deserialization (Incomplete fix for CVE-2026-54514)\n\nCVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)\n\nCVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy\n\nCVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)\n\nThis patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.17.3 from Maven Central.","status":"published","published":"2026-09-23T15:56:22Z","modified":"2026-10-27T04:12:59.117996426Z","cvss":[{"version":"3.1","score":5.6,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-804d65df1a73952a","title":"Lightwell Security Advisory: jackson-databind 2.18.0.rhlw-00010","description":"Red Hat Lightwell has released com.fasterxml.jackson.core:jackson-databind 2.18.0.rhlw-00010 with backported fixes for CVE-2026-19032, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, and CVE-2026-83557.\n\nCVE-2026-19032: jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path\n\nCVE-2026-54513: jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)\n\nCVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)\n\nCVE-2026-54515: jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties\n\nCVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy\n\nCVE-2026-59889: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization\n\nCVE-2026-83557: jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types\n\nThis patched artifact is a drop-in replacement for com.fasterxml.jackson.core:jackson-databind 2.18.0 from Maven Central.","status":"published","published":"2026-09-16T12:33:26Z","modified":"2026-10-27T04:13:02.989872193Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2026-59888","description":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.","status":"published","published":"2026-07-14T17:17:00Z","modified":"2026-10-17T12:59:14.258204382Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1789494210","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.2-tuxcare.1.","status":"published","published":"2026-09-15T17:43:30Z","modified":"2026-10-15T09:47:43.884727214Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1791487635","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.17.3-tuxcare.3.","status":"published","published":"2026-10-08T19:27:15Z","modified":"2026-10-15T09:47:44.885262122Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791545828","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.1-tuxcare.1.","status":"published","published":"2026-10-09T11:37:08Z","modified":"2026-10-15T09:47:45.281986412Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792441007","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (9 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 9 CVEs. Fixed in 2.15.0-tuxcare.1.","status":"published","published":"2026-10-19T20:16:47Z","modified":"2026-10-20T01:45:02.666970276Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441426","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.4-tuxcare.1.","status":"published","published":"2026-10-19T20:23:46Z","modified":"2026-10-20T01:45:04.432952872Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441448","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.3-tuxcare.1.","status":"published","published":"2026-10-19T20:24:08Z","modified":"2026-10-20T01:45:03.627926753Z","updated_at":"2026-11-02T15:43:54.119956Z"},{"id":"CLSA-2026-1792441664","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.2-tuxcare.1.","status":"published","published":"2026-10-19T20:27:44Z","modified":"2026-10-20T01:45:02.661348231Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792441755","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.18.5-tuxcare.1.","status":"published","published":"2026-10-19T20:29:15Z","modified":"2026-10-20T01:45:03.739069417Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792441929","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.3-tuxcare.1.","status":"published","published":"2026-10-19T20:32:09Z","modified":"2026-10-20T01:45:02.666967137Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792442035","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.0-tuxcare.1.","status":"published","published":"2026-10-19T20:33:55Z","modified":"2026-10-20T01:45:05.331170489Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792475167","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.16.1-tuxcare.1.","status":"published","published":"2026-10-20T05:46:07Z","modified":"2026-10-20T07:15:05.273214174Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479593","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.2-tuxcare.1.","status":"published","published":"2026-10-20T06:59:53Z","modified":"2026-10-20T13:45:05.854054468Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479645","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.4-tuxcare.1.","status":"published","published":"2026-10-20T07:00:45Z","modified":"2026-10-20T13:45:06.964335796Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479649","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.19.0-tuxcare.1.","status":"published","published":"2026-10-20T07:00:49Z","modified":"2026-10-20T13:45:04.961743059Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792479685","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.20.1-tuxcare.1.","status":"published","published":"2026-10-20T07:01:25Z","modified":"2026-10-20T13:45:04.955717329Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792516705","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.16.0-tuxcare.1.","status":"published","published":"2026-10-20T17:18:25Z","modified":"2026-10-20T19:30:06.493571349Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792516904","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.2-tuxcare.1.","status":"published","published":"2026-10-20T17:21:44Z","modified":"2026-10-20T19:30:06.282244926Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792516966","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.18.4-tuxcare.1.","status":"published","published":"2026-10-20T17:22:46Z","modified":"2026-10-20T19:30:05.876490537Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792517919","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.17.0-tuxcare.1.","status":"published","published":"2026-10-20T17:38:39Z","modified":"2026-10-20T19:30:06.480905637Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792517950","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (7 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 7 CVEs. Fixed in 2.16.2-tuxcare.1.","status":"published","published":"2026-10-20T17:39:10Z","modified":"2026-10-20T19:30:06.38058255Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1792517982","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (6 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 6 CVEs. Fixed in 2.15.1-tuxcare.1.","status":"published","published":"2026-10-20T17:39:42Z","modified":"2026-10-20T19:30:06.379447907Z","updated_at":"2026-11-02T15:43:54.672859Z"},{"id":"CLSA-2026-1793201235","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (8 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 8 CVEs. Fixed in 2.21.2-tuxcare.1.","status":"published","published":"2026-10-28T15:27:15Z","modified":"2026-10-28T19:45:02.437154468Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"CLSA-2026-1793869125","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.6.1-tuxcare.4.","status":"published","published":"2026-11-05T09:58:46Z","modified":"2026-11-05T13:15:05.739922606Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793869236","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.7.1-tuxcare.5.","status":"published","published":"2026-11-05T10:00:37Z","modified":"2026-11-05T13:15:05.285900518Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793869689","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (5 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 5 CVEs. Fixed in 2.14.3-tuxcare.2.","status":"published","published":"2026-11-05T10:08:10Z","modified":"2026-11-05T13:15:06.595205142Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793870483","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.13.1-tuxcare.4.","status":"published","published":"2026-11-05T10:21:24Z","modified":"2026-11-05T13:15:10.629805523Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793871662","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 2 CVEs. Fixed in 2.12.6-tuxcare.3.","status":"published","published":"2026-11-05T10:41:03Z","modified":"2026-11-05T13:15:10.176879384Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793871768","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (3 CVEs)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 3 CVEs. Fixed in 2.12.5-tuxcare.4.","status":"published","published":"2026-11-05T10:42:49Z","modified":"2026-11-05T13:15:10.084461486Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793871871","title":"TuxCare security update for tools.jackson.core:jackson-databind (2 CVEs)","description":"TuxCare rebuilt tools.jackson.core:jackson-databind to address 2 CVEs. Fixed in 3.1.2-tuxcare.4.","status":"published","published":"2026-11-05T10:44:32Z","modified":"2026-11-05T13:15:10.679090878Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793872442","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.7-tuxcare.5.","status":"published","published":"2026-11-05T10:54:03Z","modified":"2026-11-05T13:15:09.168470017Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793872782","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.14.2-tuxcare.6.","status":"published","published":"2026-11-05T10:59:43Z","modified":"2026-11-05T13:15:10.686605613Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793873198","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.1-tuxcare.4.","status":"published","published":"2026-11-05T11:06:38Z","modified":"2026-11-05T13:15:08.253807532Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793873326","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.5-tuxcare.4.","status":"published","published":"2026-11-05T11:08:47Z","modified":"2026-11-05T13:15:06.694640626Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793873445","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.4.2-tuxcare.4.","status":"published","published":"2026-11-05T11:10:46Z","modified":"2026-11-05T13:15:10.06997919Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793873541","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.3-tuxcare.3.","status":"published","published":"2026-11-05T11:12:21Z","modified":"2026-11-05T13:15:10.074722946Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793873763","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.4-tuxcare.4.","status":"published","published":"2026-11-05T11:16:04Z","modified":"2026-11-05T13:15:08.557274717Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793873891","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.12.2-tuxcare.4.","status":"published","published":"2026-11-05T11:18:11Z","modified":"2026-11-05T13:15:10.079500939Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793874157","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.4-tuxcare.3.","status":"published","published":"2026-11-05T11:22:38Z","modified":"2026-11-05T13:15:10.17524946Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1793874356","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.14.1-tuxcare.4.","status":"published","published":"2026-11-05T11:25:56Z","modified":"2026-11-05T13:15:09.160323996Z","updated_at":"2026-11-05T13:30:00.949926Z"},{"id":"CLSA-2026-1794231263","title":"TuxCare security update for com.fasterxml.jackson.core:jackson-databind (1 CVE)","description":"TuxCare rebuilt com.fasterxml.jackson.core:jackson-databind to address 1 CVE. Fixed in 2.13.0-tuxcare.4.","status":"published","published":"2026-11-09T14:34:23Z","modified":"2026-11-09T19:15:06.861864177Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"openSUSE-SU-2026:11279-1","title":"jackson-databind-2.18.9-2.1 on GA media","description":"These are all security issues fixed in the jackson-databind-2.18.9-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-15T00:00:00Z","modified":"2026-07-16T10:00:16.324475661Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21375-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of\n  @JsonIgnoreProperties exclusions (bsc#1268902).\n- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to\n  @JsonView restricted fields (bsc#1271440).\n- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of\n  @JsonIgnore restrictions (bsc#1271442).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.9.\n\nChanges for jackson-core:\n\n- Update to 2.18.9.\n\nChanges for jackson-databind:\n\n- Update to 2.18.9:\n\n * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).\n","status":"published","published":"2026-07-18T12:43:11Z","modified":"2026-07-22T18:25:11.632837758Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22822-1","title":"Security update for jackson-annotations, jackson-core, jackson-databind","description":"This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of\n  @JsonIgnoreProperties exclusions (bsc#1268902).\n- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to\n  @JsonView restricted fields (bsc#1271440).\n- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of\n  @JsonIgnore restrictions (bsc#1271442).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.9.\n\nChanges for jackson-core:\n\n- Update to 2.18.9.\n\nChanges for jackson-databind:\n\n- Update to 2.18.9:\n\n * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).\n","status":"published","published":"2026-07-18T12:45:10Z","modified":"2026-07-28T18:24:07.92045676Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:3273-1","title":"Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base","description":"This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:\n\n- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of\n  @JsonIgnoreProperties exclusions (bsc#1268902).\n- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to\n  @JsonView restricted fields (bsc#1271440).\n- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of\n  @JsonIgnore restrictions (bsc#1271442).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.9.\n\nChanges for jackson-bom:\n\n- Update to 2.18.9.\n\nChanges for jackson-core:\n\n- Update to 2.18.9.\n\nChanges for jackson-databind:\n\n- Update to 2.18.9:\n\n * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).\n\nChanges for jackson-dataformats-binary:\n\n- Update to 2.18.9.\n\nChanges for jackson-modules-base:\n\n- Update to 2.18.9.\n","status":"published","published":"2026-07-27T11:32:29Z","modified":"2026-07-28T10:00:06.125570338Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}