CVE-2026-59889Medium· 6.5▾ Sunlitjackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Jul 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
0.3% → 0.4%
Last analysed / modified upstream
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
jackson-databind >= 2.0.0-RC1, < 2.18.9jackson-databind >= 2.19.0, < 2.21.5jackson-databind >= 2.22.0, < 2.22.1jackson-databind >= 3.0.0, < 3.1.5jackson-databind >= 3.2.0, < 3.2.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
tools.jackson.core:jackson-databind >= 3.0.0, <= 3.1.4com.fasterxml.jackson.core:jackson-databind >= 2.22.0, < 2.22.1tools.jackson.core:jackson-databind >= 3.2.0, < 3.2.1com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.5com.fasterxml.jackson.core:jackson-databind >= 2.0.0-RC1, < 2.18.9Patched in:
tools.jackson.core:jackson-databind 3.1.5com.fasterxml.jackson.core:jackson-databind 2.22.1tools.jackson.core:jackson-databind 3.2.1com.fasterxml.jackson.core:jackson-databind 2.21.5com.fasterxml.jackson.core:jackson-databind 2.18.9Source: https://github.com/advisories/GHSA-5gvw-p9qm-jgwh
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91777High· 7.5Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91776High· 7.5TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID
CVE-2026-89425High· 7.5UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending Java identifier characters to a StringBuilder in a loop that has no upper bound
CVE-2026-89407High· 7.5NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT ([+-]?[0-9]*[\.]?[0-9]+([eE][+-]?[0-9]+)?), present since 2.17.0, and PATTERN_FLOAT_TRAILING_DOT…
CVE-2026-68497High· 7.5jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLD…
CVE-2018-12023High· 7.5An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6