CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4
https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d
https://github.com/FasterXML/jackson-databind/pull/5974
https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) jackson-databind contiene la funcionalidad de enlace de datos de propósito general y el modelo de árbol para el Procesador de Datos Jackson. Desde 2.15.0 hasta 2.18.8, 2.21.4 y 3.1.4, los Registros Java que utilizan una PropertyNamingStrategy pueden eludir @JsonIgnore porque POJOPropertiesCollector._removeUnwantedIgnorals() registra un componente ignorado bajo su nombre implícito original antes de que _renameUsing() aplique la estrategia de nomenclatura, permitiendo que la clave JSON renombrada se asigne al parámetro del constructor del Registro. Este problema está solucionado en las versiones 2.18.8, 2.21.4 y 3.1.4.

Information

Published : 2026-07-14 17:17

Updated : 2026-10-24 21:10

NVD link : CVE-2026-59888

Mitre link : CVE-2026-59888

CVE.ORG link : CVE-2026-59888

JSON object : View

Products Affected

No product.

CWE

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

{"id": "CVE-2026-59888", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59888", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T17:51:54.891859Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "FasterXML", "product": "jackson-databind", "versions": [{"status": "affected", "version": ">= 2.15.0, < 2.18.8"}, {"status": "affected", "version": ">= 2.19.0, < 2.21.4"}, {"status": "affected", "version": ">= 3.0.0, < 3.1.4"}]}]}], "published": "2026-07-14T17:17:15.137", "references": [{"url": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4", "source": "security-advisories@github.com"}, {"url": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d", "source": "security-advisories@github.com"}, {"url": "https://github.com/FasterXML/jackson-databind/pull/5974", "source": "security-advisories@github.com"}, {"url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-915"}]}], "descriptions": [{"lang": "en", "value": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4."}, {"lang": "es", "value": "jackson-databind contiene la funcionalidad de enlace de datos de prop\u00f3sito general y el modelo de \u00e1rbol para el Procesador de Datos Jackson. Desde 2.15.0 hasta 2.18.8, 2.21.4 y 3.1.4, los Registros Java que utilizan una PropertyNamingStrategy pueden eludir @JsonIgnore porque POJOPropertiesCollector._removeUnwantedIgnorals() registra un componente ignorado bajo su nombre impl\u00edcito original antes de que _renameUsing() aplique la estrategia de nomenclatura, permitiendo que la clave JSON renombrada se asigne al par\u00e1metro del constructor del Registro. Este problema est\u00e1 solucionado en las versiones 2.18.8, 2.21.4 y 3.1.4."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "security-advisories@github.com"}