CVE-2026-59889
- Source
- https://cve.org/CVERecord?id=CVE-2026-59889
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59889.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-59889
- Aliases
- Downstream
- Related
- Published
- 2026-07-14T19:57:48.473Z
- Modified
- 2026-08-12T16:41:39.173402Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
- Details
-
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json", "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-863" ] }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh
- https://nvd.nist.gov/vuln/detail/CVE-2026-59889
- https://github.com/FasterXML/jackson-databind/issues/6060
- https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b
- https://github.com/FasterXML/jackson-databind/pull/6056
Affected packages
Git / github.com/fasterxml/jackson-databind
Affected ranges
- Type
- GIT
- Repo
- https://github.com/fasterxml/jackson-databind
- Events
-
IntroducedIntroducedIntroducedIntroducedIntroducedFixedFixedFixedFixedFixedFixed
- Database specific
-
Show details
{ "source": [ "AFFECTED_FIELD", "REFERENCES" ], "extracted_events": [ { "introduced": "2.18.0" }, { "fixed": "2.18.9" }, { "introduced": "2.21.0" }, { "fixed": "2.21.5" }, { "introduced": "2.22.0" }, { "fixed": "2.22.1" }, { "introduced": "3.0.0" }, { "fixed": "3.1.5" }, { "introduced": "3.2.0" }, { "fixed": "3.2.1" } ] }
Affected versions
jackson-databind-2.*
jackson-databind-2.18.0
jackson-databind-2.18.1
jackson-databind-2.18.2
jackson-databind-2.18.3
jackson-databind-2.18.4
jackson-databind-2.18.5
jackson-databind-2.18.6
jackson-databind-2.18.7
jackson-databind-2.18.8
jackson-databind-2.21.0
jackson-databind-2.21.1
jackson-databind-2.21.2
jackson-databind-2.21.3
jackson-databind-2.21.4
jackson-databind-2.22.0
jackson-databind-3.*
jackson-databind-3.0.0
jackson-databind-3.0.1
jackson-databind-3.1.0
jackson-databind-3.1.0-rc1
jackson-databind-3.1.1
jackson-databind-3.1.2
jackson-databind-3.1.3
jackson-databind-3.1.4
jackson-databind-3.2.0
Database specific
vanir_signatures_modified
"2026-08-12T16:41:39Z"
vanir_signatures
[
{
"digest": {
"function_hash": "38219315850865968457985822492614804225",
"length": 355.0
},
"signature_type": "Function",
"source": "https://github.com/fasterxml/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b",
"id": "CVE-2026-59889-6fa09bb3",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java",
"function": "processUnwrapped"
}
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"69111130285733665845842448509825191069",
"131745598759607440769632991380110159691",
"227038717324575151299858168555311193390",
"70431490580368147867302567538728532153",
"109037359334413101786264361763256054936",
"39558650246812817006721738270444780294"
]
},
"signature_type": "Line",
"source": "https://github.com/fasterxml/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b",
"id": "CVE-2026-59889-7420522f",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java"
}
}
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59889.json"