Skip to main content

jackson-databind CVE-2026-59889

| EUVDEUVD-2026-44506 MEDIUM
Incorrect Authorization (CWE-863)
2026-07-14 GitHub_M GHSA-5gvw-p9qm-jgwh
Authentication Bypass Jackson Databind Suse
6.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vuln.today AI
7.5 HIGH

Archetypal exploit targets a public registration endpoint requiring no authentication; view-bypass is the sole integrity impact with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

4
Source Code Evidence Fetched
Jul 22, 2026 - 14:02 vuln.today
Analysis Generated
Jul 22, 2026 - 14:02 vuln.today
Patch available
Jul 14, 2026 - 23:20 EUVD
CVE Published
Jul 14, 2026 - 19:57 cve.org
MEDIUM 6.5

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 5,222 maven packages depend on com.fasterxml.jackson.core:jackson-databind (1,712 direct, 3,567 indirect)
  • 367 maven packages depend on tools.jackson.core:jackson-databind (101 direct, 266 indirect)

Ecosystem-wide dependent count for version 2.21.0 and other introduced versions.

DescriptionCVE.org

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

AnalysisAI

jackson-databind's @JsonView authorization guard is bypassable on deserialization when a property carries both @JsonView and @JsonUnwrapped annotations, allowing an authenticated or unauthenticated attacker to mass-assign privileged fields through a less-privileged active view. Affected are com.fasterxml.jackson.core:jackson-databind 2.18.0-2.18.8, 2.21.0-2.21.4, 2.22.0, and tools.jackson.core:jackson-databind 3.0.0-3.1.4, 3.2.0. A publicly available proof-of-concept demonstrates the bypass; SSVC reports no confirmed active exploitation at time of analysis, and EPSS sits at 0.42% (34th percentile), indicating low current threat velocity despite the high-integrity impact.

Technical ContextAI

jackson-databind (Maven: com.fasterxml.jackson.core:jackson-databind, CPE: cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*) is the core JSON data-binding layer of the Jackson Data Processor, ubiquitous in Java/Spring ecosystems. The root cause (CWE-863 - Incorrect Authorization) lies in UnwrappedPropertyHandler.processUnwrapped(): when replaying buffered JSON for an @JsonUnwrapped property it calls prop.deserializeAndSet() without first evaluating the prop.visibleInView(ctxt.getActiveView()) guard. This guard was correctly applied in the parallel method processUnwrappedCreatorProperties() as part of prior fix GHSA-rcqc-6cw3-h962, and is also applied by BeanDeserializer.deserializeWithUnwrapped for directly-matched properties. The missing guard means that a container property annotated @JsonView(AdminView) @JsonUnwrapped has its sub-fields populated from untrusted JSON even when the ObjectMapper is operating under a more restrictive view such as PublicView. The fix (PR #6056, commit d627a8a) adds an activeView != null check and a !prop.visibleInView(activeView) short-circuit continue inside the iteration loop in processUnwrapped().

RemediationAI

The primary remediation is to upgrade jackson-databind to a fixed release: 2.18.9, 2.21.5, or 2.22.1 for the 2.x line, and 3.1.5 or 3.2.1 for the 3.x line. The patch is available via Maven Central and the fix is confirmed in PR #6056 (https://github.com/FasterXML/jackson-databind/pull/6056) and commit d627a8a86fcb062429282f79f3f256f181ed2c7b. For applications that cannot upgrade immediately, a concrete compensating control is to avoid combining @JsonUnwrapped with @JsonView on the same container property; instead, separate the privileged nested object into a non-unwrapped property so the existing BeanDeserializer view gate applies correctly. A second workaround is to perform an explicit allowlist check on sensitive fields in a custom deserializer or @JsonCreator rather than relying solely on @JsonView for write-side authorization - this eliminates the dependency on the missing library-level gate. Note that DEFAULT_VIEW_INCLUSION=true (the 2.x default) means all non-annotated properties are included regardless of view; applications on 3.x with DEFAULT_VIEW_INCLUSION=false have a narrower exposure surface but are still affected where the specific @JsonView + @JsonUnwrapped combination is present. Full advisory: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh.

More in Jackson Databind

View all
CVE-2020-11113 HIGH
8.8 Mar 31

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9548 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35728 HIGH
8.1 Dec 27

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35491 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-9547 CRITICAL POC
9.8 Mar 02

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-35490 HIGH POC
8.1 Dec 17

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2020-36183 HIGH POC
8.1 Jan 07

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, rela
CVE-2022-42004 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeseriali
CVE-2022-42003 HIGH POC
7.5 Oct 02

In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of
CVE-2019-12086 HIGH POC
7.5 May 17

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. Rated high severity (CVSS 7.5)
CVE-2020-25649 HIGH
7.5 Dec 03

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. Rated high seve
CVE-2020-10673 HIGH
8.8 Mar 18

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, rela

Same weakness CWE-863 – Incorrect Authorization

View all
CVE-2025-54253 CRITICAL POC
10.0
CVE-2025-24200 MEDIUM
6.1
CVE-2023-21715 HIGH
7.3
CVE-2025-21480 HIGH
8.6
CVE-2025-21479 HIGH
8.6
CVE-2025-32462 HIGH POC
8.8
CVE-2017-4915 HIGH POC
7.8
CVE-2024-6782 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Leap 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected

Share

CVE-2026-59889 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy