CVE-2026-59888

EUVD-2026-43957
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 23.05%
Debian logo
Debian Releases
Debian Product
Codename
jackson-databind
bookworm
2.14.0-1+deb12u1
fixed
bookworm (security)
2.14.0-1+deb12u1
fixed
bullseye
2.12.1-1+deb11u1
fixed
bullseye (security)
2.12.1-1+deb11u2
fixed
forky
2.14.0+ds-2
fixed
sid
2.14.0+ds-2
fixed
trixie
2.14.0+ds-1+deb13u1
fixed
trixie (security)
2.14.0+ds-1+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
jackson-databind
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
needs-triage
trusty
needs-triage
xenial
needs-triage
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
jackson-annotations
suse enterprise desktop 15 SP7
2.18.9-150200.3.25.1
fixed
suse enterprise sap 15 SP7
2.18.9-150200.3.25.1
fixed
suse enterprise server 15 SP4
2.18.9-150200.3.25.1
fixed
suse enterprise server 15 SP7
2.18.9-150200.3.25.1
fixed
jackson-core
suse enterprise desktop 15 SP7
2.18.9-150200.3.25.1
fixed
suse enterprise sap 15 SP7
2.18.9-150200.3.25.1
fixed
suse enterprise server 15 SP4
2.18.9-150200.3.25.1
fixed
suse enterprise server 15 SP7
2.18.9-150200.3.25.1
fixed
jackson-databind
suse enterprise desktop 15 SP7
2.18.9-150200.3.33.1
fixed
suse enterprise sap 15 SP7
2.18.9-150200.3.33.1
fixed
suse enterprise server 15 SP4
2.18.9-150200.3.33.1
fixed
suse enterprise server 15 SP7
2.18.9-150200.3.33.1
fixed
jackson-dataformat-cbor
suse enterprise server 15 SP4
2.18.9-150200.3.24.1
fixed
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4
https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d
https://github.com/FasterXML/jackson-databind/pull/5974
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5