A medium-severity vulnerability, CVE-2026-59888 with a CVSS score of 6.5, affects the jackson-databind library when using Java Records and a PropertyNamingStrategy. When a @JsonIgnore-annotated component is renamed, its original implicit name remains in the _ignoredPropertyNames list, allowing it to be deserialized from the wire via its renamed key. This can lead to an internal/privileged component being set by an untrusted client, compromising the security of the application. The vulnerability occurs when a Record uses a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization. Affected versions include those between 2.15.0 and 2.18.8, 2.19.0 and 2.21.4, and 3.0.0 and 3.1.4.
We recommend you to update jackson-databind to version 2.18.8, 2.21.4, or 3.1.4.[/subscribe_to_unlock_form]
A medium-severity vulnerability, CVE-2026-59888 with a CVSS score of 6.5, affects the jackson-databind library when using Java Records and a PropertyNamingStrategy. When a @JsonIgnore-annotated component is renamed, its original implicit name remains in the _ignoredPropertyNames list, allowing it to be deserialized from the wire via its renamed key. This can lead to an internal/privileged component being set by an untrusted client, compromising the security of the application. The vulnerability occurs when a Record uses a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization. Affected versions include those between 2.15.0 and 2.18.8, 2.19.0 and 2.21.4, and 3.0.0 and 3.1.4.
We recommend you to update jackson-databind to version 2.18.8, 2.21.4, or 3.1.4.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]