Skip to main content

jackson-databind CVE-2026-59888

| EUVDEUVD-2026-43957 MEDIUM
Improperly Controlled Modification of Dynamically-Determined Object Attributes (CWE-915)
2026-07-14 GitHub_M GHSA-3pjw-73gf-8qr5
Authentication Bypass Java Jackson Databind Suse Red Hat
6.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vuln.today AI
6.5 MEDIUM

Network vector and no privileges required because attacker only needs to submit JSON to an exposed endpoint; AC:L because no per-request complexity is needed once the target endpoint is identified, despite the code-level prerequisites on the server side.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

4
Patch available
Jul 14, 2026 - 23:21 EUVD
Source Code Evidence Fetched
Jul 14, 2026 - 21:50 vuln.today
Analysis Generated
Jul 14, 2026 - 21:50 vuln.today
CVE Published
Jul 14, 2026 - 16:44 cve.org
MEDIUM 6.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 6,441 maven packages depend on com.fasterxml.jackson.core:jackson-databind (1,784 direct, 4,666 indirect)
  • 370 maven packages depend on tools.jackson.core:jackson-databind (101 direct, 269 indirect)

Ecosystem-wide dependent count for version 2.15.0 and other introduced versions.

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

AnalysisAI

Deserialization logic in FasterXML jackson-databind 2.15.0 through 2.18.7, 2.21.3, and 3.1.3 allows unauthenticated remote callers to bypass @JsonIgnore annotations on Java Record types when a PropertyNamingStrategy is configured. The renamed JSON key - e.g., 'internal_role' produced by SnakeCaseStrategy from 'internalRole' - is not registered in the ignore list, so Jackson's constructor-parameter binding accepts the attacker-supplied value despite the developer's explicit exclusion directive. No public exploit tooling has been identified at time of analysis, but the upstream fix PR includes a runnable proof-of-concept test that fully demonstrates the bypass, lowering the bar for independent reproduction.

Technical ContextAI

jackson-databind (CPE: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*) is the dominant JSON serialization library for the Java ecosystem, used pervasively in Spring Boot, Quarkus, Dropwizard, and similar frameworks. The flaw resides in POJOPropertiesCollector, specifically the interaction between _removeUnwantedIgnorals() and _renameUsing(). For standard POJO classes, Jackson removes @JsonIgnore-marked properties from the property map before renaming runs, so the order is inconsequential. For Java Records (available since Java 16 as a stable feature), the ignore registration happens by recording the component's implicit name - the camelCase field name - into _ignoredPropertyNames. When _renameUsing() subsequently applies a PropertyNamingStrategy, it produces a new string key (e.g., 'internal_role') but never propagates the ignore status to that new key. The fix in commit baa2cdf5/c7c67836 adds a check inside _renameUsing() that detects when an original name is in _ignoredPropertyNames and immediately adds the renamed key to the ignored set via _collectIgnorals(). CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) captures the root cause class: the framework's dynamic attribute-binding logic fails to honour an exclusion constraint when attribute names are transformed.

RemediationAI

Upgrade jackson-databind to version 2.18.8, 2.21.4, or 3.1.4 as appropriate for the branch in use - these are the confirmed fix versions per the upstream GitHub advisory (https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5) and the merged PR (https://github.com/FasterXML/jackson-databind/pull/5974). The fix is surgical - a null-check and a single _collectIgnorals() call in _renameUsing() - so upgrading is low-risk. For teams unable to patch immediately, a targeted workaround is to replace Java Record types that carry @JsonIgnore fields with standard POJO classes (annotated with @JsonProperty explicitly), since the POJO deserialization path correctly drops ignored properties before renaming runs and is not affected by this bug. A second workaround is to remove the PropertyNamingStrategy from the ObjectMapper or the affected class and instead use explicit @JsonProperty annotations for field name mapping; this eliminates the renaming step that triggers the bypass, at the cost of more verbose annotations. Do not rely on schema validation or upstream API gateways as the sole mitigation, as JSON field name filtering at the gateway layer would need to account for strategy-renamed names and is fragile.

More in Java

View all
CVE-2012-4681 CRITICAL POC
9.8 Aug 28

Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
CVE-2015-7450 CRITICAL POC
9.8 Jan 02

Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
CVE-2013-2465 CRITICAL POC
9.8 Jun 18

Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
CVE-2011-3544 CRITICAL POC
9.8 Oct 19

Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
CVE-2010-1871 HIGH POC
8.8 Aug 05

JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
CVE-2012-1723 CRITICAL POC
9.8 Jun 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
CVE-2013-0422 CRITICAL POC
9.8 Jan 10

Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
CVE-2012-0507 CRITICAL POC
9.8 Jun 07

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
CVE-2015-4852 CRITICAL POC
9.8 Nov 18

The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers

CVE-2012-5076 CRITICAL POC
9.8 Oct 16

Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
CVE-2017-3066 CRITICAL POC
9.8 Apr 27

Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
CVE-2012-0391 CRITICAL POC
9.8 Jan 08

The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during

Same weakness CWE-915 – Improperly Controlled Modification of Dynamically-Determined Object Attributes

View all
CVE-2026-50160 CRITICAL POC
10.0
CVE-2026-33453 CRITICAL POC
10.0
CVE-2024-5452 CRITICAL POC
9.8
CVE-2022-31106 CRITICAL POC
9.8
CVE-2021-21368 HIGH POC
8.8
CVE-2026-42044 CRITICAL POC
9.1
CVE-2024-0404 CRITICAL POC
9.1
CVE-2026-40897 HIGH POC
8.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

CVE-2026-59888 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy