PT-2026-58288 · Unknown · Jackson-Databind

Published 2026-07-14 · Updated 2026-07-14 · CVE-2026-59888

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.15.0 through 2.18.7 jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.1.0 through 3.1.3

Description Java Records using a PropertyNamingStrategy can bypass the @JsonIgnore annotation. This occurs because the POJOPropertiesCollector. removeUnwantedIgnorals() function records an ignored component using its original implicit name before the renameUsing() function applies the naming strategy. Consequently, the renamed JSON key can be assigned to the Record constructor parameter.

Recommendations Update to version 2.18.8 Update to version 2.21.4 Update to version 3.1.4

Exploit

Fix

Weakness Enumeration

CWE-915

Related Identifiers

CVE-2026-59888

GHSA-3PJW-73GF-8QR5

Affected Products

Jackson-Databind

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59888.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-59888 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-59888 · Security Note
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5 · Note
• https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d · Note
• https://github.com/FasterXML/jackson-databind/pull/5974 · Note
• https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4 · Note