CVE-2026-59888Medium· 6.5▾ SunlitA flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
0.2% → 0.4%
Last analysed / modified upstream
A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an untrusted client could set internal or privileged components from external input, potentially leading to unauthorized modification or disclosure of sensitive data.
com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records — rated Moderate by Red Hat. Released 2026-07-14, updated 2026-10-06.
Affected:
Fixed:
No fix planned:
Not affected:
For more information visit https://access.redhat.com/errata/RHSA-2026:68699 https://access.redhat.com/errata/RHSA-2026:68699 Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.
The References section of this erratum contains a download link (you must log in to download the update). https://access.redhat.com/errata/RHSA-2026:66545 The container images provided by this update can be downloaded from the Red Hat container registry at registry.redhat.io using the "podman pull" command.
For details on deploying and configuring RHEL AI, see the Red Hat Enterprise Linux AI documentation at https://docs.redhat.com/en/documentation/red_hat_enterprise_linux_ai/3.3 https://access.redhat.com/errata/RHSA-2026:76041
Affected packages:
com.fasterxml.jackson.core:jackson-databind >= 2.15.0, < 2.18.8com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.4tools.jackson.core:jackson-databind >= 3.0.0, < 3.1.4Patched in:
com.fasterxml.jackson.core:jackson-databind 2.18.8com.fasterxml.jackson.core:jackson-databind 2.21.4tools.jackson.core:jackson-databind 3.1.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67314High· 7.4axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling (lib/adapters/http.js and lib/helpers/resolveConfig.js)
CVE-2026-108106High· 7.5Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input
CVE-2026-56816High· 7.5io.netty:netty-codec-http3: Netty: Denial of Service due to uncontrolled memory buffering in HTTP/3 (CVE-2026-56816)
CVE-2026-45536Medium· 4.0netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message han…
CVE-2026-54518Medium· 6.5jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass (CVE-2026-54518)
CVE-2026-54514Medium· 5.3jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution (CVE-2026-54514)