Medium severity6.5OSV Advisory· Published Jul 14, 2026· Updated Jul 15, 2026
CVE-2026-59888
CVE-2026-59888
Description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
com.fasterxml.jackson.core:jackson-databindMaven | >= 2.15.0, < 2.18.8 | 2.18.8 |
com.fasterxml.jackson.core:jackson-databindMaven | >= 2.19.0, < 2.21.4 | 2.21.4 |
tools.jackson.core:jackson-databindMaven | >= 3.0.0, < 3.1.4 | 3.1.4 |
Affected products
20- osv-coords18 versionspkg:apk/chainguard/nacos-dockerpkg:rpm/opensuse/jackson-databind&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/jackson-annotations&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/jackson-core&distro=openSUSE%20Leap%2016.0pkg:rpm/opensuse/jackson-databind&distro=openSUSE%20Leap%2016.0pkg:apk/chainguard/jenkins-2.568-openjdk-25pkg:apk/chainguard/akhqpkg:apk/chainguard/flywaypkg:apk/chainguard/jenkins-2.568pkg:apk/chainguard/lmcache-cuda-12.8pkg:apk/chainguard/opensearch-3-securitypkg:apk/chainguard/opensearch-fips-3-securitypkg:apk/chainguard/sonarqubepkg:apk/wolfi/flywaypkg:apk/chainguard/jenkins-2.568-openjdk-21pkg:apk/wolfi/akhqpkg:apk/wolfi/opensearch-3-securitypkg:apk/wolfi/sonarqube
< 3.2.3-r2+ 17 more
- (no CPE)range: < 3.2.3-r2
- (no CPE)range: < 2.18.9-2.1
- (no CPE)range: < 2.18.9-160000.1.1
- (no CPE)range: < 2.18.9-160000.1.1
- (no CPE)range: < 2.18.9-160000.1.1
- (no CPE)range: < 2.568.1-r2
- (no CPE)range: < 0.28.0-r2
- (no CPE)range: < 13.0.0-r1
- (no CPE)range: < 2.568.1-r2
- (no CPE)range: < 0.5.4-r0
- (no CPE)range: < 3.7.0-r13
- (no CPE)range: < 3.7.0-r12
- (no CPE)range: < 26.8.0.126808-r1
- (no CPE)range: < 13.0.0-r1
- (no CPE)range: < 2.568.1-r2
- (no CPE)range: < 0.28.0-r2
- (no CPE)range: < 3.7.0-r13
- (no CPE)range: < 26.8.0.126808-r1
- Range: jackson-databind-3.1.3, jackson-databind-2.21.3, jackson-databind-2.18.7, …
- Range: 2.15.0 - 2.18.8, 2.21.4, 3.1.4
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-3pjw-73gf-8qr5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-59888ghsaADVISORY
- github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4nvdWEB
- github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9dnvdWEB
- github.com/FasterXML/jackson-databind/pull/5974nvdWEB
- github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5nvdWEB
News mentions
0No linked articles in our index yet.