{"id":"CVE-2026-59889","title":"jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization","summary":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cvssSource":"cna","cwe":["CWE-863","CWE-915"],"vendor":"FasterXML","product":"jackson-databind","affected":["jackson-databind >= 2.0.0-RC1, < 2.18.9","jackson-databind >= 2.19.0, < 2.21.5","jackson-databind >= 2.22.0, < 2.22.1","jackson-databind >= 3.0.0, < 3.1.5","jackson-databind >= 3.2.0, < 3.2.1"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-16T14:50:03.943048Z"},"published":"2026-07-14","updated":"2026-10-19","sourceUpdated":"2026-10-19T19:32:26.642Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59889","references":[{"url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh","label":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"},{"url":"https://github.com/FasterXML/jackson-databind/issues/6060","label":"https://github.com/FasterXML/jackson-databind/issues/6060"},{"url":"https://github.com/FasterXML/jackson-databind/pull/6056","label":"https://github.com/FasterXML/jackson-databind/pull/6056"},{"url":"https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","label":"https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889"},{"url":"https://github.com/advisories/GHSA-5gvw-p9qm-jgwh"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59889.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59889"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500653"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59889"},{"url":"https://access.redhat.com/errata/RHSA-2026:70230"},{"url":"https://access.redhat.com/errata/RHSA-2026:67604"},{"url":"https://access.redhat.com/errata/RHSA-2026:70228"},{"url":"https://access.redhat.com/errata/RHSA-2026:70229"},{"url":"https://access.redhat.com/errata/RHSA-2026:67603"},{"url":"https://access.redhat.com/errata/RHSA-2026:70277"}],"tags":["cve.org","ghsa","maven","csaf","vex","red-hat"],"aliases":["GHSA-5gvw-p9qm-jgwh"],"ecosystem":"maven","patched":["tools.jackson.core:jackson-databind 3.1.5","com.fasterxml.jackson.core:jackson-databind 2.22.1","tools.jackson.core:jackson-databind 3.2.1","com.fasterxml.jackson.core:jackson-databind 2.21.5","com.fasterxml.jackson.core:jackson-databind 2.18.9"],"epss":0.00346,"epssPercentile":0.27994,"ingestedAt":"2026-07-21T22:55:08.724Z","slug":"CVE-2026-59889","body":"## Overview\n\njackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.\n\n## Affected\n\n- `jackson-databind >= 2.0.0-RC1, < 2.18.9`\n- `jackson-databind >= 2.19.0, < 2.21.5`\n- `jackson-databind >= 2.22.0, < 2.22.1`\n- `jackson-databind >= 3.0.0, < 3.1.5`\n- `jackson-databind >= 3.2.0, < 3.2.1`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-59889)\n\nAffected packages:\n\n- `tools.jackson.core:jackson-databind >= 3.0.0, <= 3.1.4`\n- `com.fasterxml.jackson.core:jackson-databind >= 2.22.0, < 2.22.1`\n- `tools.jackson.core:jackson-databind >= 3.2.0, < 3.2.1`\n- `com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.5`\n- `com.fasterxml.jackson.core:jackson-databind >= 2.0.0-RC1, < 2.18.9`\n\nPatched in:\n\n- `tools.jackson.core:jackson-databind 3.1.5`\n- `com.fasterxml.jackson.core:jackson-databind 2.22.1`\n- `tools.jackson.core:jackson-databind 3.2.1`\n- `com.fasterxml.jackson.core:jackson-databind 2.21.5`\n- `com.fasterxml.jackson.core:jackson-databind 2.18.9`\n\nSource: https://github.com/advisories/GHSA-5gvw-p9qm-jgwh\n\n## Vendor advisories\n\n- **RHSA-2026:70230** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 10 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70230)\n- **RHSA-2026:67604** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server, Red Hat JBoss EAP 7.4 ELS for RHEL 8, Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67604)\n- **RHSA-2026:70228** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70228)\n- **RHSA-2026:70229** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70229)\n- **RHSA-2026:67603** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.4.25 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67603)\n- **RHSA-2026:70277** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70277)\n- **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat AI Inference Server, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, … · no fix planned: Exploit Intelligence, OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat AI Inference Server, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59889.json)","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}