--- id: CVE-2026-59889 title: >- jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization summary: >- jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered … severity: medium cvss: 6.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N' cvssSource: cna cwe: - CWE-863 - CWE-915 vendor: FasterXML product: jackson-databind affected: - 'jackson-databind >= 2.0.0-RC1, < 2.18.9' - 'jackson-databind >= 2.19.0, < 2.21.5' - 'jackson-databind >= 2.22.0, < 2.22.1' - 'jackson-databind >= 3.0.0, < 3.1.5' - 'jackson-databind >= 3.2.0, < 3.2.1' ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-07-16T14:50:03.943048Z' published: '2026-07-14' updated: '2026-10-19' sourceUpdated: '2026-10-19T19:32:26.642Z' source: CVEORG sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-59889' references: - url: >- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh label: >- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh - url: 'https://github.com/FasterXML/jackson-databind/issues/6060' label: 'https://github.com/FasterXML/jackson-databind/issues/6060' - url: 'https://github.com/FasterXML/jackson-databind/pull/6056' label: 'https://github.com/FasterXML/jackson-databind/pull/6056' - url: >- https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b label: >- https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-59889' - url: 'https://github.com/advisories/GHSA-5gvw-p9qm-jgwh' - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59889.json - url: 'https://access.redhat.com/security/cve/CVE-2026-59889' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2500653' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-59889' - url: 'https://access.redhat.com/errata/RHSA-2026:70230' - url: 'https://access.redhat.com/errata/RHSA-2026:67604' - url: 'https://access.redhat.com/errata/RHSA-2026:70228' - url: 'https://access.redhat.com/errata/RHSA-2026:70229' - url: 'https://access.redhat.com/errata/RHSA-2026:67603' - url: 'https://access.redhat.com/errata/RHSA-2026:70277' tags: - cve.org - ghsa - maven - csaf - vex - red-hat aliases: - GHSA-5gvw-p9qm-jgwh ecosystem: maven patched: - 'tools.jackson.core:jackson-databind 3.1.5' - 'com.fasterxml.jackson.core:jackson-databind 2.22.1' - 'tools.jackson.core:jackson-databind 3.2.1' - 'com.fasterxml.jackson.core:jackson-databind 2.21.5' - 'com.fasterxml.jackson.core:jackson-databind 2.18.9' epss: 0.00346 epssPercentile: 0.27994 ingestedAt: '2026-07-21T22:55:08.724Z' --- ## Overview jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1. ## Affected - `jackson-databind >= 2.0.0-RC1, < 2.18.9` - `jackson-databind >= 2.19.0, < 2.21.5` - `jackson-databind >= 2.22.0, < 2.22.1` - `jackson-databind >= 3.0.0, < 3.1.5` - `jackson-databind >= 3.2.0, < 3.2.1` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Package advisory (CVE-2026-59889) Affected packages: - `tools.jackson.core:jackson-databind >= 3.0.0, <= 3.1.4` - `com.fasterxml.jackson.core:jackson-databind >= 2.22.0, < 2.22.1` - `tools.jackson.core:jackson-databind >= 3.2.0, < 3.2.1` - `com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.5` - `com.fasterxml.jackson.core:jackson-databind >= 2.0.0-RC1, < 2.18.9` Patched in: - `tools.jackson.core:jackson-databind 3.1.5` - `com.fasterxml.jackson.core:jackson-databind 2.22.1` - `tools.jackson.core:jackson-databind 3.2.1` - `com.fasterxml.jackson.core:jackson-databind 2.21.5` - `com.fasterxml.jackson.core:jackson-databind 2.18.9` Source: https://github.com/advisories/GHSA-5gvw-p9qm-jgwh ## Vendor advisories - **RHSA-2026:70230** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 10 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70230) - **RHSA-2026:67604** · Red Hat · fixed in: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server, Red Hat JBoss EAP 7.4 ELS for RHEL 8, Red Hat JBoss EAP 7.4 ELS for RHEL 9 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67604) - **RHSA-2026:70228** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 8 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70228) - **RHSA-2026:70229** · Red Hat · fixed in: Red Hat JBoss EAP 8.1 for RHEL 9 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70229) - **RHSA-2026:67603** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 7.4.25 · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67603) - **RHSA-2026:70277** · Red Hat · fixed in: Red Hat JBoss Enterprise Application Platform 8.1 · released 2026-09-22 · [advisory](https://access.redhat.com/errata/RHSA-2026:70277) - **Red Hat VEX** · Moderate · affected: Exploit Intelligence, OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat AI Inference Server, Red Hat AMQ Broker 7, Red Hat Ansible Automation Platform 2, … · no fix planned: Exploit Intelligence, OpenShift Developer Tools and Services, OpenShift Serverless, Red Hat AI Inference Server, … · updated 2026-10-16 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59889.json)