ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-59889

jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

Published Jul 21, 2026 · catalog updated Oct 19, 2026 · jackson-databind: @JsonView bypassed for

Check if you run it

No confirmed exploitation is on record for CVE-2026-59889. EPSS is 0.35%. Act only if a listed version of jackson-databind: @JsonView bypassed for is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (jackson-databind: @JsonView bypassed for).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.35%
Remediation
Advisory link
Affected products
Maven com.fasterxml.jackson.core:jackson-databind · Maven tools.jackson.core:jackson-databind

## Summary replays the buffered JSON for a property by iterating its properties and calling with **no guard** — the exact guard received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard applies to directly-matched properties. As a result, a property annotated with both and is written from attacker JSON even when deserializing under a more-restrictive active view. **Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner (the unwrapped sub-object's own gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**. ## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6) An property that is NOT → under (correctly gated). The identical property WITH → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method. ## Impact — write-side mass-assignment / privilege escalation is commonly used as a write-side authorization guard: a public endpoint binds the body under and groups privileged state in a nested object whose container property is . When that property is , an untrusted caller mass-assigns it. PoC: a self-service registration where is ; attacker JSON under binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high ( ); no worse than the C:L/I:L parent and arguably higher as -as-write-guard is the exact use case #5971/#5969 defended. ## Affected - 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). default=true. - 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). default=false → the stock-config repro is the common shape where privileged inner fields are individually and the developer relies on the container ; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.) ## Additive variants (runtime-confi

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Maven com.fasterxml.jackson.core:jackson-databind2.0.0-RC1 → 2.18.9
  • Maven com.fasterxml.jackson.core:jackson-databind2.19.0 → 2.21.5
  • Maven com.fasterxml.jackson.core:jackson-databind2.22.0 → 2.22.1
  • Maven tools.jackson.core:jackson-databind3.0.0 → 3.1.5
  • Maven tools.jackson.core:jackson-databind3.2.0 → 3.2.1

How to fix CVE-2026-59889

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-59889. EPSS is 0.35%. Act only if a listed version of jackson-databind: @JsonView bypassed for is installed.

Which versions are affected?

Compare what you have installed with 2.0.0-RC1 → 2.18.9, 2.19.0 → 2.21.5, 2.22.0 → 2.22.1, 3.0.0 → 3.1.5, 3.2.0 → 3.2.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-863: Incorrect Authorization. EPSS 0.35%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 21, 2026 · GitHub Advisory Database

    Detected

    ## Summary replays the buffered JSON for a property by iterating its properties and calling with **no guard** — the exact guard received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard applies to directly-matched properties. As a result, a property annotated with both and is written from attacker JSON even when deserializing under a more-restrictive active view. **Correction to the original

  2. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    com.fasterxml.jackson.core:jackson-databind fixed in 2.21.5; tools.jackson.core:jackson-databind fixed in 3.1.5; com.fasterxml.jackson.core:jackson-databind fixed in 2.18.9; com.fasterxml.jackson.core:jackson-databind fixed in 2.22.1

  3. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    com.fasterxml.jackson.core:jackson-databind fixed in 2.21.5

  4. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    tools.jackson.core:jackson-databind fixed in 3.1.5

  5. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    com.fasterxml.jackson.core:jackson-databind fixed in 2.18.9

  6. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    com.fasterxml.jackson.core:jackson-databind fixed in 2.22.1

  7. Oct 19, 2026 · GitHub Advisory Database

    Fix available

    tools.jackson.core:jackson-databind fixed in 3.2.1

  8. Oct 19, 2026 · GitHub Advisory Database

    Updated

    ## Summary replays the buffered JSON for a property by iterating its properties and calling with **no guard** — the exact guard received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard applies to directly-matched properties. As a result, a property annotated with both and is written from attacker JSON even when deserializing under a more-restrictive active view. **Correction to the original

Sources

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.