CVE catalog

CVE-2026-59888

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStra

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.42% · Oct 25, 2026

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjackson-databindsid2.22.4-1not affected
Debianjackson-databindforky2.18.11-1not affected
Debianjackson-databindtrixie2.14.0+ds-1+deb13u1not affected
Debianjackson-databindtrixie-security2.14.0+ds-1+deb13u1not affected
Debianjackson-databindbookworm2.14.0-1+deb12u1not affected
Debianjackson-databindbookworm-security2.14.0-1+deb12u1not affected
Mavencom.fasterxml.jackson.core:jackson-databindNot reported2.18.8fixed
Mavencom.fasterxml.jackson.core:jackson-databindNot reported2.21.4fixed
Maventools.jackson.core:jackson-databindNot reported3.1.4fixed
Opensusejackson-databindtumbleweed2.18.9-2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjackson-databindsourcesidNot affectedunimportantNot reportedNot reported
Debianjackson-databindsourceforkyNot affectedunimportantNot reportedNot reported
Debianjackson-databindsourcetrixieNot affectedunimportantNot reportedNot reported
Debianjackson-databindsourcebookwormNot affectedunimportantNot reportedNot reported
Mavencom.fasterxml.jackson.core:jackson-databindmavenNot reported2.18.8Not reportedNot reportedNot reported
Mavencom.fasterxml.jackson.core:jackson-databindmavenNot reported2.21.4Not reportedNot reportedNot reported
Maventools.jackson.core:jackson-databindmavenNot reported3.1.4Not reportedNot reportedNot reported
Opensusejackson-databindrpmtumbleweed2.18.9-2.1Not reportedOPENSUSE-SU-2026:11279-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [jackson-databind-javadoc]Unknown

    Source package: [jackson-databind]

    Details (1)

    • 2.18.9-2.2 · noarch · tumbleweed

      Unknown · Fixed: 2.18.9-2.1

      Version impact unknown

      nvd · jackson-databind · opensuse · tumbleweed

  • [jackson-databind]Fixed

    Source package: [jackson-databind]

    Details (1)

    • 2.18.9-2.2 · noarch · tumbleweed

      Fixed · Fixed: 2.18.9-2.1

      nvd · jackson-databind · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libjackson2-databind-java]Not affected

    Source package: [jackson-databind]

    Details (4)

    • 2.14.0-1+deb12u1 · all · bookworm

      Not affected

      nvd · jackson-databind · debian · bookworm

    • 2.14.0-1+deb12u1 · all · bookworm

      Not affected

      nvd · jackson-databind · debian · bookworm

    • 2.14.0-1+deb12u1 · all · bookworm-security

      Not affected

      nvd · jackson-databind · debian · bookworm

    • 2.14.0-1+deb12u1 · all · bookworm-security

      Not affected

      nvd · jackson-databind · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]