CVE-2026-59889

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-59889
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59889.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-59889
Aliases
Downstream
CGA (1123)
CLEANSTART (28)
CLSA (3)
ECHO (1)
MINI (74)
openSUSE (2)
RHLW (1)
RHSA (4)
ROOT (1)
SUSE (2)
UBUNTU (1)
Related
openSUSE (2)
SUSE (2)
Published
2026-07-14T19:57:48Z
Modified
2026-10-20T13:03:35Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
Details

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json"
}
References

Affected packages

Git / github.com/fasterxml/jackson-databind

Affected ranges

Type
GIT
Repo
https://github.com/fasterxml/jackson-databind
Events
Introduced
9af5904b805fa07a00757fe2d24c1f931b502254
Fixed
f7b3266eb21a232b35520d31ce5e304beb8f1c7c
Introduced
f644a920f4ac768797edf7709070411837c83ef8
Fixed
09b89813cde3c8a56c696b5b5fb415fa4a1f1d51
Introduced
ed2541fedfc6005fd249343f01e6090c8c3395f6
Fixed
446f4ce26371980a5634cf47fedc376b5e411ac6
Introduced
d51183e4fa171235bcd31c63268c5ad1745afb8c
Fixed
a4f1f5e2b7bfce0ca55db9d4769de98fa911df83
Introduced
0f45333297a3d0504f2706c2aff2177586150d25
Fixed
5d74e874671faef1d786cd6d25abfd02daa4c682
Fixed
d627a8a86fcb062429282f79f3f256f181ed2c7b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "2.0.0-RC1"
                },
                {
                    "fixed":  "2.18.9"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "2.19.0"
                },
                {
                    "fixed":  "2.21.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "2.22.0"
                },
                {
                    "fixed":  "2.22.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "3.0.0"
                },
                {
                    "fixed":  "3.1.5"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "3.2.0"
                },
                {
                    "fixed":  "3.2.1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "d627a8a86fcb062429282f79f3f256f181ed2c7b"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

2.*
2.2.0c
2.6.0-rc3b
jackson-databind-2.*
jackson-databind-2.0.0
jackson-databind-2.0.0-RC1
jackson-databind-2.0.0-RC2
jackson-databind-2.0.0-RC3
jackson-databind-2.0.1
jackson-databind-2.0.2
jackson-databind-2.1.0
jackson-databind-2.1.1
jackson-databind-2.10.0
jackson-databind-2.10.0.pr1
jackson-databind-2.10.0.pr2
jackson-databind-2.10.0.pr3
jackson-databind-2.11.0
jackson-databind-2.11.0.rc1
jackson-databind-2.12.0
jackson-databind-2.12.0-rc1
jackson-databind-2.12.0-rc2
jackson-databind-2.12.1
jackson-databind-2.13.0
jackson-databind-2.13.0-rc1
jackson-databind-2.13.0-rc2
jackson-databind-2.14.0
jackson-databind-2.14.0-rc1
jackson-databind-2.14.0-rc2
jackson-databind-2.14.0-rc3
jackson-databind-2.15.0
jackson-databind-2.15.0-rc1
jackson-databind-2.15.0-rc2
jackson-databind-2.15.0-rc3
jackson-databind-2.16.0
jackson-databind-2.16.0-rc1
jackson-databind-2.17.0-rc1
jackson-databind-2.18.0
jackson-databind-2.18.0-rc1
jackson-databind-2.18.1
jackson-databind-2.18.2
jackson-databind-2.18.3
jackson-databind-2.18.4
jackson-databind-2.18.5
jackson-databind-2.18.6
jackson-databind-2.18.7
jackson-databind-2.18.8
jackson-databind-2.19.0
jackson-databind-2.2.0
jackson-databind-2.2.1
jackson-databind-2.2.2
jackson-databind-2.20.0
jackson-databind-2.20.0-rc1
jackson-databind-2.21.0
jackson-databind-2.21.1
jackson-databind-2.21.2
jackson-databind-2.21.3
jackson-databind-2.21.4
jackson-databind-2.22.0
jackson-databind-2.3.0
jackson-databind-2.3.0-rc1
jackson-databind-2.3.1
jackson-databind-2.4.0
jackson-databind-2.4.0-rc1
jackson-databind-2.4.0-rc2
jackson-databind-2.4.0-rc3
jackson-databind-2.4.1
jackson-databind-2.4.1.1
jackson-databind-2.4.1.2
jackson-databind-2.4.1.3
jackson-databind-2.5.0
jackson-databind-2.5.0-rc1
jackson-databind-2.6.0
jackson-databind-2.6.0-rc1
jackson-databind-2.6.0-rc4
jackson-databind-2.6.1
jackson-databind-2.7.0
jackson-databind-2.7.0-rc1
jackson-databind-2.7.0-rc2
jackson-databind-2.7.0-rc3
jackson-databind-2.7.1
jackson-databind-2.7.1-1
jackson-databind-2.8.0
jackson-databind-2.8.1
jackson-databind-2.8.2
jackson-databind-2.9.0
jackson-databind-2.9.0.pr1
jackson-databind-2.9.0.pr2
jackson-databind-2.9.0.pr3
jackson-databind-2.9.0.pr4
jackson-databind-2.9.1
jackson-databind-2.9.3
jackson-databind-2.9.4
jackson-databind-2.9.5
jackson-databind-2.9.6
jackson-databind-3.*
jackson-databind-3.0.0
jackson-databind-3.0.1
jackson-databind-3.1.0
jackson-databind-3.1.0-rc1
jackson-databind-3.1.1
jackson-databind-3.1.2
jackson-databind-3.1.3
jackson-databind-3.1.4
jackson-databind-3.2.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-59889.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "38219315850865968457985822492614804225",
            "length":  355
        },
        "id":  "CVE-2026-59889-6fa09bb3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/fasterxml/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b",
        "target":  {
            "file":  "src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java",
            "function":  "processUnwrapped"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "69111130285733665845842448509825191069",
                "131745598759607440769632991380110159691",
                "227038717324575151299858168555311193390",
                "70431490580368147867302567538728532153",
                "109037359334413101786264361763256054936",
                "39558650246812817006721738270444780294"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-59889-7420522f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/fasterxml/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b",
        "target":  {
            "file":  "src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-20T13:03:35Z"