CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Awaiting analysis

AliasesUBUNTU-CVE-2026-59888CGA-2qj9-2q2r-cprvCGA-35hm-4p8q-jw5r+486 more

Published 14-07-2026Last modified 14-07-2026

Vulnerability summary

CVE-2026-59888 is a medium (CVSS 6.5) vulnerability in fasterxml jackson-databind. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.5/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.42%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 5

OPENSUSE-SU-2026:11279-1 OPENSUSE-SU-2026:21375-1 SUSE-SU-2026:22822-1 SUSE-SU-2026:3273-1 CGA-26P9-W832-5Q9C

Timeline

14-07-2026
PublishedVulnerability first disclosed.
14-07-2026
Last modifiedVulnerability information updated.

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.5

EPSS trend

Probability

0.42%

Chance of exploitation in the next 30 days

Percentile

37%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.42% on 05-10-2026

05-10-202604-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-915Improperly Controlled Modification of Dynamically-Determined Object AttributesThe product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard140 products

airflow-2All versions (No fix recorded)
akhq< 0.28.0-r1 | < 0.28.0-r2
apache-nifiAll versions (No fix recorded)
apache-nifi-2.11All versions (No fix recorded) | < 2.11.0-r6
apache-nifi-2.12All versions (No fix recorded)

apache-polarisAll versions (No fix recorded)
apache-polaris-fipsAll versions (No fix recorded)
apache-pulsar-4.1All versions (No fix recorded)
apache-pulsar-fips-4.1All versions (No fix recorded)
apache-tika-3.2< 3.2.3-r18
camunda-zeebe-8.6< 8.6.39-r14
commercial-elasticsearch-8.17All versions (No fix recorded)
commercial-elasticsearch-9.1All versions (No fix recorded)
commercial-elasticsearch-9.2All versions (No fix recorded)
commercial-elasticsearch-9.4< 9.4.8-r0
commercial-elasticsearch-9.5< 9.5.5-r0
druid< 37.0.0-r56 | All versions (No fix recorded) | < 38.0.0-r1
eco-java-gradle-7.6.4All versions (No fix recorded)
eco-java-gradle-7.6.5All versions (No fix recorded)
eco-java-gradle-7.6.6All versions (No fix recorded)
eco-java-gradle-8.10All versions (No fix recorded)
eco-java-gradle-8.10.1All versions (No fix recorded)
eco-java-gradle-8.10.2All versions (No fix recorded)
eco-java-gradle-8.11All versions (No fix recorded)
eco-java-gradle-8.11.1All versions (No fix recorded)
eco-java-gradle-8.12All versions (No fix recorded)
eco-java-gradle-8.12.1All versions (No fix recorded)
eco-java-gradle-8.13All versions (No fix recorded)
eco-java-gradle-8.14All versions (No fix recorded)
eco-java-gradle-8.14.1All versions (No fix recorded)
eco-java-gradle-8.14.2All versions (No fix recorded)
eco-java-gradle-8.14.3All versions (No fix recorded)
eco-java-gradle-8.14.4All versions (No fix recorded)
eco-java-gradle-8.14.5All versions (No fix recorded)
eco-java-gradle-8.5All versions (No fix recorded)
eco-java-gradle-8.6All versions (No fix recorded)
eco-java-gradle-8.7All versions (No fix recorded)
eco-java-gradle-8.8All versions (No fix recorded)
eco-java-gradle-8.9All versions (No fix recorded)
eco-java-gradle-9.0.0All versions (No fix recorded)
eco-java-gradle-9.1.0All versions (No fix recorded)
eco-java-gradle-9.2.0All versions (No fix recorded)
eco-java-gradle-9.2.1All versions (No fix recorded)
eco-java-gradle-9.3.0All versions (No fix recorded)
eco-java-gradle-9.3.1All versions (No fix recorded)
eco-java-gradle-9.4.0All versions (No fix recorded)
eco-java-gradle-9.4.1All versions (No fix recorded)
eco-java-gradle-9.5.0All versions (No fix recorded)
eco-java-gradle-9.5.1All versions (No fix recorded)
eco-java-gradle-9.6.0All versions (No fix recorded)
eco-java-gradle-9.6.1All versions (No fix recorded)
elasticsearch-9.1All versions (No fix recorded)
elasticsearch-9.1-iamguardedAll versions (No fix recorded)
elasticsearch-9.1-iamguarded-fipsAll versions (No fix recorded)
elasticsearch-9.2< 9.2.8-r17
elasticsearch-9.2-iamguarded< 9.2.8-r13
elasticsearch-9.2-iamguarded-fips< 9.2.8-r16
elasticsearch-9.3-iamguarded-fips< 9.3.8-r0
elasticsearch-9.4< 9.4.7-r2
elasticsearch-9.4-iamguarded< 9.4.5-r3
elasticsearch-9.4-iamguarded-fips< 9.4.7-r3 | < 9.4.5-r5
elasticsearch-9.5< 9.5.2-r6
elasticsearch-9.5-iamguarded< 9.5.2-r6
elasticsearch-9.5-iamguarded-fips< 9.5.2-r5
elasticsearch-fips-9.1All versions (No fix recorded)
elasticsearch-fips-9.2< 9.2.8-r16
elasticsearch-fips-9.3< 9.3.8-r0
elasticsearch-fips-9.4< 9.4.7-r3 | < 9.4.5-r5
elasticsearch-fips-9.5< 9.5.2-r5
flyway< 13.0.0-r1
hadoop-fips-3.5< 3.5.0-r8
jenkins-2.541All versions (No fix recorded)
jenkins-2.541-openjdk-17All versions (No fix recorded)
jenkins-2.541-openjdk-21All versions (No fix recorded)
jenkins-2.541-openjdk-25All versions (No fix recorded)
jenkins-2.568< 2.568.1-r2
jenkins-2.568-openjdk-21< 2.568.1-r2
jenkins-2.568-openjdk-25< 2.568.1-r2
kayenta-2025.2All versions (No fix recorded)
kayenta-2025.4All versions (No fix recorded)
kayenta-2026.0All versions (No fix recorded)
kayenta-2026.1All versions (No fix recorded)
kayenta-2026.2All versions (No fix recorded)
kayenta-fips-2025.2All versions (No fix recorded)
kayenta-fips-2025.4All versions (No fix recorded)
kayenta-fips-2026.0All versions (No fix recorded)
kayenta-fips-2026.1All versions (No fix recorded)
kayenta-fips-2026.2All versions (No fix recorded)
keycloak-26.5< 26.5.7-r8
keycloak-26.5-iamguarded-compat< 26.5.7-r8
keycloak-26.5-operator< 26.5.7-r8
keycloak-fips-26.5< 26.5.7-r14
keycloak-fips-26.5-iamguarded-fips< 26.5.7-r14
keycloak-fips-26.5-operator< 26.5.7-r14
knative-kafka-broker-1.20-dispatcher-loom< 1.20.3-r19
knative-kafka-broker-1.20-receiver-loom< 1.20.3-r19
knative-kafka-broker-fips-1.20-dispatcher-loom< 1.20.3-r17
knative-kafka-broker-fips-1.20-receiver-loom< 1.20.3-r17
lmcache-cuda-12.8< 0.5.4-r0
logstash-9.2All versions (No fix recorded)
logstash-9.2-iamguarded-compatAll versions (No fix recorded)
logstash-9.2-with-output-opensearchAll versions (No fix recorded)
logstash-9.3All versions (No fix recorded)
logstash-9.3-iamguarded-compatAll versions (No fix recorded)
nacos-docker< 3.2.3-r2
neo4j-2025.12All versions (No fix recorded)
neo4j-2026.01All versions (No fix recorded)
neo4j-2026.02< 2026.02.3-r6
neo4j-2026.03< 2026.03.1-r6
neo4j-2026.04< 2026.04.0-r5
opensearch-2-security-analytics< 2.19.6-r15
opensearch-3-discovery-ec2< 3.8.0-r3
opensearch-3-iamguarded-compat< 3.8.0-r3
opensearch-3-neural-searchAll versions (No fix recorded)
opensearch-3-security< 3.7.0-r13
opensearch-fips-3-security< 3.7.0-r12
pinot< 1.5.1-r22
pinot-fips< 1.5.1-r18
rangerAll versions (No fix recorded)
s3proxy-fipsAll versions (No fix recorded) | < 4.1.1-r5
scala-3.3All versions (No fix recorded) | < 3.3.9-r1
sonarqube< 26.8.0.126808-r1 | < 26.8.0.126808-r0
spark-3.5-scala-2.12All versions (No fix recorded) | < 3.5.9-r9
spark-3.5-scala-2.13All versions (No fix recorded) | < 3.5.9-r9
spark-4.0-scala-2.13< 4.0.4-r8 | < 4.0.5-r1 | All versions (No fix recorded)
spark-4.1-scala-2.13< 4.1.3-r3 | All versions (No fix recorded)
spark-4.2-scala-2.13< 4.2.0-r8 | All versions (No fix recorded)
spark-fips-3.5-scala-2.12< 3.5.8-r14 | All versions (No fix recorded)
spark-fips-3.5-scala-2.13< 3.5.8-r14 | All versions (No fix recorded)
spark-fips-4.1-scala-2.13< 4.1.2-r11
spark-fips-4.2-scala-2.13< 4.2.0-r7 | < 4.2.0-r8
strimzi-kafka-operator-cluster-operator< 1.2.0-r4
strimzi-kafka-operator-kafka-init< 1.2.0-r4
strimzi-kafka-operator-topic-operator< 1.2.0-r4
trino< 483-r7
trino-plugin-bigqueryAll versions (No fix recorded)
trino-plugin-opensearch< 483-r7
trino-plugin-oracle< 483-r7
wso2is< 7.3.0-r5 | < 7.3.0-r3 | < 7.3.0-r4
zaproxyAll versions (No fix recorded)

Show all 140

Wolfi27 products

akhq< 0.28.0-r1 | < 0.28.0-r2
apache-nifiAll versions (No fix recorded)
apache-pulsar-4.1All versions (No fix recorded)
apache-tika-3.2< 3.2.3-r18
druid< 37.0.0-r56 | All versions (No fix recorded) | < 38.0.0-r1

Show all 27

Com.fasterxml.jackson.core1 product

jackson-databind≥ 2.15.0, < 2.18.8 | ≥ 2.19.0, < 2.21.4

Fasterxml1 product

jackson-databind≥ 2.15.0, < 2.18.8 | ≥ 2.19.0, < 2.21.4 | ≥ 3.0.0, < 3.1.4

Tools.jackson.core1 product

jackson-databind≥ 3.0.0, < 3.1.4

Ubuntu1 product

jackson-databindAll versions (No fix recorded)

6 vendors · 171 products

References

9 links

github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5X Refsource CONFIRMREPORTAdvisoryWEB
github.com/FasterXML/jackson-databind/pull/5974X Refsource MISCREPORTFIXWEB
github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4X Refsource MISCREPORTFIXWEB
github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9dX Refsource MISCREPORTFIXWEB
ubuntu.com/security/CVE-2026-59888REPORT
www.cve.org/CVERecord?id=CVE-2026-59888REPORT
github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59888.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2026-59888Advisory
github.com/FasterXML/jackson-databindPACKAGE