CVE-2026-59888

Aliases:GHSA-3pjw-73gf-8qr5CGA-2qj9-2q2r-cprvCGA-3mwv-5h92-m49pCGA-4j7g-4vh4-q43fCGA-4v55-xmjg-fj9fCGA-56jq-m8h5-rqv4CGA-5f72-jh37-v736CGA-5m4f-p62h-m22hCGA-5qg2-wp55-w3pjCGA-6fjw-mcw4-m779CGA-6qgv-2fqc-pg32CGA-7355-jh45-4v8qCGA-74rv-9vmw-78q8CGA-77w4-qxqp-qhvvCGA-7gp3-hp42-rmc8CGA-7m8v-g4pw-4mfpCGA-7vxj-m454-2mp6CGA-7wfv-xh33-jqvjCGA-7wwf-v34v-p77gCGA-82r7-jxqr-hq85CGA-88w8-pvmg-44mwCGA-89w7-3c2w-57hcCGA-8j5m-whg5-77vqCGA-8jj7-wqrm-vccmCGA-8w6c-jj8x-gwfwCGA-9fg4-q2rp-7p3fCGA-cw33-5xrh-f2q4CGA-fjh8-f89m-vcccCGA-fjh8-vvwr-vv8hCGA-fr98-37m3-37c4CGA-g247-rgvv-29f6CGA-gf4j-9m67-26pqCGA-gpg3-7wj4-29w8CGA-gwf6-pjj5-m39xCGA-j35h-4fvw-f278CGA-j725-249h-cpp5CGA-j8f7-r7w5-7975CGA-jpjr-753q-97mfCGA-jxpm-f82g-xxg4CGA-p93g-2h6p-xpx9CGA-pfp2-rc9j-p7xhCGA-ppfr-433h-h74hCGA-22g8-467r-hpwxCGA-2382-xfgp-3j42CGA-23g4-m74f-qwgrCGA-23jx-9fh2-98h5CGA-2577-cxqw-g6qhCGA-25qq-jp9f-q27pCGA-268c-7466-4x87CGA-26rr-63x9-rxr6CGA-26xw-vjpm-g65cCGA-2783-4ffx-c73cCGA-27fr-fq8j-9h64CGA-2965-8v43-74fmCGA-2c4m-5qhm-x5gcCGA-2jw2-vrfj-8vp2CGA-2mpp-r4xg-qmchCGA-2pxr-8vfv-mcjjCGA-2q22-g326-g8qpCGA-2r9q-3gvm-p2h7CGA-2v83-6xwr-jp27CGA-2v97-23pc-5xphCGA-2wg4-v952-qmpgCGA-2xfx-p7hf-f2cqCGA-32fv-69hg-c58mCGA-335v-cr9q-jwr4CGA-35wg-v4vr-r53gCGA-36c2-v29c-88mwCGA-3769-cfj8-c9pqCGA-38m2-2rhm-g4qwCGA-38p3-vc87-6jg4CGA-39qw-3cvw-4vpxCGA-3cqv-gfhq-9f3gCGA-3cw8-h29j-gc3cCGA-3fr7-mr47-x8c7CGA-3jqj-hpv2-mccmCGA-3m7f-j8f2-7mw8CGA-3pf5-8992-5pfhCGA-3pfv-vq47-mf65CGA-3v7f-jc9r-hwwpCGA-3wf6-fr62-xr2vCGA-3x54-9p5f-87xrCGA-3x86-4c49-w86mCGA-3xfc-cmjj-j6p3CGA-42c2-3mff-92g4CGA-44f9-xw9f-5v28CGA-44rv-crfw-37gfCGA-458v-3xw3-x7wxCGA-474p-mffp-m44xCGA-47c2-2mp8-pv94CGA-4cvj-qc5r-mjcxCGA-4f7x-gr26-ggr6CGA-4fm6-5qp9-2cvrCGA-4fmm-5f8j-f695CGA-4gp4-g437-jhmqCGA-4gr7-9qx8-qqvmCGA-4h87-jf2w-59wwCGA-4jch-m9wq-pxvfCGA-4p89-4g6q-r27wCGA-4pqr-c25p-9gh8CGA-4q72-74p9-65hvCGA-4v9w-gx38-p54rCGA-559c-6wq6-m884CGA-55wg-w6hm-9wqpCGA-56qw-7hcm-7xpcCGA-587m-jfgv-qwmhCGA-59wg-2hvf-9hcfCGA-5f7c-f222-mm5gCGA-5fcr-wq8v-rrwgCGA-5fx5-qpqj-rr5cCGA-5hp8-f647-c9pvCGA-5m43-6gqx-qr2wCGA-5mq6-c3rx-cq68CGA-5p7g-g9g6-fxq7CGA-5qxh-x7q7-f8gfCGA-5rcq-chg3-p28gCGA-5rx7-m79q-f38wCGA-5wj8-rjp6-97gvCGA-5x7q-796p-mw6qCGA-6587-f9h9-h85vCGA-66ch-337x-85jxCGA-66h5-x7vw-2wmjCGA-673r-3527-fpgwCGA-67r9-5h9h-5j3cCGA-6c37-w8vw-xfwmCGA-6cp8-cmp5-jvqxCGA-6f75-v2xc-65c8CGA-6hcp-v4h2-qghfCGA-6pcp-7635-cggmCGA-6qq4-f67r-q6q8CGA-6qvh-mq2c-694mCGA-6r5g-m967-w8fcCGA-6w6x-hj92-69hhCGA-6wmv-ww48-f36mCGA-729v-jrgm-6rf4CGA-738m-37q6-qvr8CGA-744g-2f84-3xpxCGA-755v-j7fg-4gm4CGA-76wp-v6fg-5323CGA-77hj-29fp-52h2CGA-78vx-q534-6qgqCGA-79qr-xp7f-hp57CGA-7crx-v2wj-ccj2CGA-7f55-rf69-49chCGA-7gjh-2grp-w96rCGA-7jwq-3rmf-f437CGA-7rqh-w9fq-3354CGA-847w-prqx-mjjmCGA-85vw-85rr-qf8vCGA-86pj-6vpc-qpgmCGA-8766-8qjw-vjmqCGA-8963-5wvx-hjw6CGA-89xx-wpxh-929cCGA-8c6r-2j92-pxv5CGA-8cwq-mpg7-9jw7CGA-8fw9-f8fj-4v3xCGA-8p7w-m4rm-mrr2CGA-8v4q-8jfj-28v9CGA-955r-5272-j8x8CGA-96c4-wf56-prg9CGA-97pq-66mj-63m6CGA-9f87-9cf8-fxg8CGA-9fjj-c2g2-v8w2CGA-9m6x-q9xg-hpgfCGA-9q8x-ff6g-crpfCGA-9rc4-955c-6q6hCGA-c46c-vxmx-qh9xCGA-c4j8-qvqh-f56qCGA-c4wm-wcfv-3qjhCGA-c63m-v593-8m6cCGA-c6c9-v3fc-xvg8CGA-c8cm-hx55-fr7xCGA-c93x-j43g-frjhCGA-cc49-jw29-xv6jCGA-cc5w-vpc2-m759CGA-ccg4-cx5q-wcmhCGA-ccxw-8rvx-5jm8CGA-cf6f-xx84-cm2rCGA-cjj6-xpfw-46f9CGA-cjm5-7gq2-cm4cCGA-cq77-v393-4x9jCGA-cq8q-2p9p-hj2mCGA-cvfx-xwmm-jq4pCGA-cw8w-3q3v-vcv6CGA-cwmh-6r7x-3mmwCGA-cx49-gwqc-6h3vCGA-cxf8-w9wg-89h8CGA-f2xj-f8p2-5hqvCGA-f584-3hgx-2rm4CGA-f5gq-h7h8-5pxcCGA-f6vq-p4gp-vfmvCGA-f7h5-w2q5-q8j8CGA-f7w9-f2x6-j4gpCGA-f7xx-gr4f-fvxwCGA-f849-83x9-7r6wCGA-f8c8-fmx3-9h4mCGA-f8w8-cg86-5r63CGA-f92r-wjf2-24m9CGA-f95j-7pcp-m8fxCGA-ff55-pm6c-ffq9CGA-fff4-32qm-gwppCGA-ffgm-gpjg-mh74CGA-fg2j-g9x5-9qjpCGA-fhxv-pj8g-7h49CGA-fpf6-mhjm-cqjrCGA-frfv-c672-3wfhCGA-frm7-8pgc-mx46CGA-fwpg-c66h-m2h3CGA-g247-r587-rj5hCGA-g2f6-q4c4-cmpmCGA-g2xr-4vrj-6h99CGA-g3jh-jrpx-p4p8CGA-g492-3wj3-6mcgCGA-g5g4-xv7x-mc72CGA-g78j-v4qh-87xhCGA-g83m-mm5c-xfxpCGA-g93g-2h2m-frq9CGA-g988-r75c-vqwwCGA-g99x-jw44-3qghCGA-gcwv-3vf6-vvrqCGA-gfw5-w8cc-ph94CGA-gjfq-rqrw-4w2mCGA-gmjj-qw3m-9v3fCGA-gqmg-7v89-pmvpCGA-gqxq-h5mf-4j63CGA-gr23-h52m-vfrcCGA-grmj-p7qm-9r82CGA-gvm8-65v9-r63pCGA-gwgc-mvwj-qgcgCGA-gwqw-qvwm-w2rfCGA-gwxx-cwp9-86rxCGA-gx2h-7gpf-47w6CGA-gxq7-5h3v-c66hCGA-gxwc-ff9w-3q45CGA-h657-65xg-fjqxCGA-h8qh-q63c-8h55CGA-hmvg-6jv7-5ffvCGA-hp2f-696p-c79fCGA-hp68-v5r6-q3f8CGA-hpfx-rc9r-3xv6CGA-hpg3-j9gm-q2rwCGA-hpgc-qx73-6f39CGA-hqpm-7485-2q8jCGA-hvgx-2xm4-74mwCGA-hwjf-pxrh-pxmmCGA-j399-rgf8-g7v9CGA-j4r9-fv83-25qqCGA-j7m4-8gqc-p9f2CGA-j7v7-855v-7cppCGA-j7vv-622p-3h9cCGA-j8jr-xmx3-9hvjCGA-j9m4-q9gm-wfm8CGA-jcr2-qvhq-vf52CGA-jh56-p97f-pgjwCGA-jhww-w25q-c743CGA-jmhf-pcw3-mqv4CGA-jprq-3xrh-r2g8CGA-jrh4-4v79-jq6fCGA-jv2m-qh73-mq6cCGA-jv4h-2xc6-gvc2CGA-jxw9-787m-h4j2CGA-m294-2f9h-hvrhCGA-m34g-xchw-v9q9CGA-m47r-7wxx-rrx8CGA-m558-6qx8-6vh3CGA-m57q-fhrr-9qx4CGA-m7v3-vw77-9776CGA-mgwq-m9r4-xfq9CGA-mm2q-c339-9733CGA-mmj3-468f-hpj3CGA-mmmx-q2q4-w9pmCGA-mp78-cmrm-f7vfCGA-mpq7-76mm-wvppCGA-mpqp-mmrq-p845CGA-mpv2-jp98-4vq8CGA-mq27-qcg3-c7jhCGA-mqp2-p4mv-f943CGA-mr85-73pp-6v8fCGA-mr9m-gfwq-wpm4CGA-p2pv-8prc-g9qvCGA-p4c8-v3jw-5c4xCGA-p6p2-69gc-vc92CGA-p7x4-jvqg-9grhCGA-p8f7-99wj-4vc9CGA-phwc-4fvh-25chCGA-phxq-r3ph-rvq8CGA-pp65-q2v9-p76jCGA-ppmv-jpcq-m8q9CGA-pqr4-hmwr-mr82CGA-pr7g-7hfv-f9v3CGA-pxq4-x5mf-mxr5CGA-pxwj-ghj4-vpr9CGA-pxwr-g3x9-pc9gCGA-q38f-x94w-5c52CGA-q3g7-f74m-g886CGA-q443-3945-4jq4CGA-q55v-x3jg-vjppCGA-q5jc-v499-cc58CGA-q6fh-rjv4-cvwxCGA-q7x8-vj29-fqvcCGA-q8jh-qgjx-rj8cCGA-q9vx-3m9j-7ghwCGA-qcc9-8jw7-47fcCGA-qcp7-pfpm-c5vjCGA-qcv3-g3vg-9frqCGA-qgqp-cxv2-8rwrCGA-qhmc-mr6p-wqfvCGA-qm6r-4xxw-g287CGA-qpfc-76hx-44frCGA-qpmw-pr3c-mpp7CGA-qpqj-w4j9-x66jCGA-qq5f-p8q4-hqvfCGA-qqhx-44j6-pvgmCGA-qr5w-cp6f-ffvwCGA-qv64-x2jf-xxghCGA-qv7m-gmgm-4f5cCGA-qwjg-2v97-mcfrCGA-r2wq-vmf3-8frxCGA-r2xx-8hcm-3873CGA-r4rr-r9xx-vmh6CGA-r6x2-wm5x-v692CGA-r733-7hgf-g9wgCGA-rfg3-2c83-8758CGA-rmg4-w52f-hmgxCGA-rmrw-q2g2-cvr4CGA-rp5w-pmg9-wfcrCGA-rpfr-ffrc-mc3qCGA-rpmw-4f66-3vgqCGA-rpv3-x9pf-hgp5CGA-rv66-8m46-89x4CGA-rvq5-xcg5-c3mhCGA-rwcv-36fr-3qg5CGA-rwj8-wv2h-45ccCGA-v23x-jp33-82fgCGA-v7x4-fhr9-fj34CGA-v87r-4m4g-h23wCGA-v996-8fh4-53mqCGA-v9j7-m976-fr4jCGA-v9vw-8cp7-8mfqCGA-v9xg-78mx-hx7jCGA-vcpw-4mpv-fq6rCGA-vg69-g44v-5m32CGA-vgj6-xrxm-vwr4CGA-vhfr-h65h-pw3vCGA-vhhw-xgf6-6c5fCGA-vhrh-h4x3-8jgjCGA-vhv6-4gm7-9chrCGA-vjjf-234q-gwwqCGA-vpx5-g4pc-wqq5CGA-vq3p-m94g-5wq6CGA-vq65-vf3j-g5jwCGA-vrv7-g288-g37jCGA-vwg3-8q6m-qjw9CGA-vwpx-h8h4-h3r8CGA-vx4g-gvmv-rcqxCGA-vxmr-gcv2-r6hmCGA-w24f-vgq3-qh5rCGA-w3qq-4xf6-rcxxCGA-w43r-fxcc-72fmCGA-w45f-9g6c-pjpmCGA-w54q-c5m6-j647CGA-w5j4-38h2-58rcCGA-w5mc-qwfr-vc7hCGA-w6h3-8vjx-6xj9CGA-w937-6699-fwhxCGA-wcf7-wm74-pvh6CGA-wf38-fp5x-mw7hCGA-wf3g-587x-73pjCGA-wfqq-9j4h-3h5vCGA-wgp8-x4qr-8vgrCGA-whhj-5q97-mvf7CGA-whrm-25rp-9wr6CGA-wp55-cw77-qhvhCGA-wqfp-8v7x-25v5CGA-wqjf-r2x2-jmmfCGA-wqr2-4vpp-4w86CGA-wwh2-5rjr-m7vcCGA-wxwv-qh39-vcpqCGA-x344-gc9c-58gfCGA-x3x9-q223-r9mhCGA-x4c4-5f82-m7qpCGA-x584-2648-33g7CGA-x5p5-3rgm-672wCGA-x63f-hfmc-572vCGA-x979-f49m-qrg8CGA-x9jv-2767-p87qCGA-xf52-x2c4-jmpjCGA-xf99-74g5-9mxvCGA-xg3h-98p5-xvghCGA-xhg8-x2m9-vf98CGA-xj6c-2cwh-ccpmCGA-xq4h-96gc-7v5vCGA-xq5p-5h6g-2rm4CGA-xq65-vwqv-7549CGA-xrp4-6wcr-pwrrCGA-xw4r-jqh2-mh8fCGA-xwvm-p64r-pwphCGA-xxqf-w5g6-2v2rCGA-57m3-4qxm-8f6qCGA-62f8-cxx9-q9x3CGA-8mjr-8m67-qvp3CGA-fm2v-3pq2-p84wCGA-frjg-g22x-65vfCGA-gv2c-qxmv-5857CGA-hvhm-72qg-9p3jCGA-qc7g-3v22-5rrmCGA-2r4c-gjqx-3ww6CGA-39x6-xj2r-v4c5CGA-5gg4-m83p-x922CGA-79xh-83gc-x5hcCGA-8pvx-wc5j-cf9hCGA-ccq4-4f3q-2x99CGA-f6jh-4g63-44w3CGA-fpg3-86wx-8wpwCGA-h5h2-4gjp-9748CGA-j3mc-xwr5-w628CGA-jw97-38fg-369gCGA-m5mp-jjcj-c3x9CGA-mwff-vxrp-qgq6CGA-qgx9-m9c7-rqf3CGA-qmwx-mvx9-q2cxCGA-v4rg-q6f3-3m8cCGA-x3gc-96rm-5q9rCGA-xcj7-x8w6-p6wwCGA-xgpr-xgv6-q7pgCGA-xr96-2hw6-38fwCGA-2phg-xgqx-w2m7CGA-3qmv-hq98-vwfqCGA-4grx-342c-qmpqCGA-87q2-xh29-gmqrCGA-8qvq-h86v-3v35CGA-9g35-m5x4-pmq7CGA-9vp9-6f76-mh83CGA-ccg3-xf9f-8w9hCGA-fhcw-mm5j-28rqCGA-fmp9-37qx-gx3xCGA-g6h4-5rw8-3vwcCGA-h2w5-rmg9-gr63CGA-j2m2-qw3m-87h7CGA-m28f-h8w3-v9rfCGA-m2q8-wxr7-wj5cCGA-mhhf-p3cw-3vprCGA-p8p7-3p98-vq9fCGA-phq5-629m-4mccCGA-pjxf-83qp-3h2qCGA-q55r-q6cc-c7h4CGA-vf38-x9v3-87mhCGA-vr98-6f7q-3qw3CGA-w449-5f93-4m98CGA-w6p9-vv3x-cwh6CGA-wxjr-p97r-6j68CGA-xwv3-57qq-mhp8CGA-j9qw-8mw3-wxj3CGA-pwp7-g537-8rv7CGA-35hm-4p8q-jw5rCGA-3x7f-c5fv-vh2vCGA-4fcr-r26f-jj5jCGA-4fg8-gj6v-g5gmCGA-4phf-57g2-5cr9CGA-745m-93wg-vgw4CGA-9whh-8hxq-f34xCGA-ch6m-2qfw-xxxvCGA-p788-58v6-v8wcCGA-pchw-rq5r-85m7CGA-rwm2-7p7r-39jpCGA-w5cr-86qh-67vfCGA-x25g-h9pp-rhpjCGA-xv7w-5gj4-xc6m
Advisory lineage Upstream: 0 Downstream: 5
Awaiting Analysis
Published: 14 Jul 2026, 16:44
Last modified:14 Jul 2026, 17:52

Vulnerability Summary

Overall Risk (default)
medium
26/100
CVSS Score
6.5 MEDIUM
v3.1 (cve.org)
EPSS Score
0.31% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Jul 2026, 16:44
Published
Vulnerability first disclosed
14 Jul 2026, 17:52
Last Modified
Vulnerability information updated

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

CVSS Metrics

  • v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.31%• Percentile: 24%

Techniques & Countermeasures

  • CWE-915•Improperly Controlled Modification of Dynamically-Determined Object Attributes

    The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Affected Systems

  • chainguard•airflow-2

    all

  • chainguard•akhq

    < 0.28.0-r1 | < 0.28.0-r2

  • chainguard•apache-nifi

    all

  • chainguard•apache-nifi-2.11

    all | < 2.11.0-r6

  • chainguard•apache-nifi-2.12

    all

  • chainguard•apache-polaris

    all

  • chainguard•apache-polaris-fips

    all

  • chainguard•apache-pulsar-4.1

    all

  • chainguard•apache-pulsar-fips-4.1

    all

  • chainguard•apache-tika-3.2

    < 3.2.3-r18

  • chainguard•camunda-zeebe-8.6

    all

  • chainguard•commercial-elasticsearch-8.17

    all

  • chainguard•commercial-elasticsearch-9.1

    all

  • chainguard•commercial-elasticsearch-9.2

    all

  • chainguard•commercial-elasticsearch-9.4

    all

  • chainguard•commercial-elasticsearch-9.5

    all

  • chainguard•druid

    all | < 37.0.0-r56

  • chainguard•eco-java-gradle-7.6.4

    all

  • chainguard•eco-java-gradle-7.6.5

    all

  • chainguard•eco-java-gradle-7.6.6

    all

  • chainguard•eco-java-gradle-8.10

    all

  • chainguard•eco-java-gradle-8.10.1

    all

  • chainguard•eco-java-gradle-8.10.2

    all

  • chainguard•eco-java-gradle-8.11

    all

  • chainguard•eco-java-gradle-8.11.1

    all

  • chainguard•eco-java-gradle-8.12

    all

  • chainguard•eco-java-gradle-8.12.1

    all

  • chainguard•eco-java-gradle-8.13

    all

  • chainguard•eco-java-gradle-8.14

    all

  • chainguard•eco-java-gradle-8.14.1

    all

  • chainguard•eco-java-gradle-8.14.2

    all

  • chainguard•eco-java-gradle-8.14.3

    all

  • chainguard•eco-java-gradle-8.14.4

    all

  • chainguard•eco-java-gradle-8.14.5

    all

  • chainguard•eco-java-gradle-8.5

    all

  • chainguard•eco-java-gradle-8.6

    all

  • chainguard•eco-java-gradle-8.7

    all

  • chainguard•eco-java-gradle-8.8

    all

  • chainguard•eco-java-gradle-8.9

    all

  • chainguard•eco-java-gradle-9.0.0

    all

  • chainguard•eco-java-gradle-9.1.0

    all

  • chainguard•eco-java-gradle-9.2.0

    all

  • chainguard•eco-java-gradle-9.2.1

    all

  • chainguard•eco-java-gradle-9.3.0

    all

  • chainguard•eco-java-gradle-9.3.1

    all

  • chainguard•eco-java-gradle-9.4.0

    all

  • chainguard•eco-java-gradle-9.4.1

    all

  • chainguard•eco-java-gradle-9.5.0

    all

  • chainguard•eco-java-gradle-9.5.1

    all

  • chainguard•eco-java-gradle-9.6.0

    all

Showing first 50 affected entries in server-rendered view.

References (7)