CVE catalog

CVE-2026-59889

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.35% · Oct 25, 2026

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianjackson-databindsid2.22.4-1not affected
Debianjackson-databindforky2.18.11-1not affected
Debianjackson-databindtrixie2.14.0+ds-1+deb13u1not affected
Debianjackson-databindtrixie-security2.14.0+ds-1+deb13u1not affected
Debianjackson-databindbookworm2.14.0-1+deb12u1not affected
Debianjackson-databindbookworm-security2.14.0-1+deb12u1not affected
Mavencom.fasterxml.jackson.core:jackson-databindNot reported2.18.9fixed
Maventools.jackson.core:jackson-databindNot reported3.2.1fixed
Mavencom.fasterxml.jackson.core:jackson-databindNot reported2.18.9fixed
Mavencom.fasterxml.jackson.core:jackson-databindNot reported2.22.1fixed
Maventools.jackson.core:jackson-databindNot reported3.2.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianjackson-databindsourcesidNot affectedunimportantNot reportedNot reported
Debianjackson-databindsourceforkyNot affectedunimportantNot reportedNot reported
Debianjackson-databindsourcetrixieNot affectedunimportantNot reportedNot reported
Debianjackson-databindsourcebookwormNot affectedunimportantNot reportedNot reported
Mavencom.fasterxml.jackson.core:jackson-databindmavenNot reported2.18.9Not reportedGHSA-5GVW-P9QM-JGWHNot reported
Maventools.jackson.core:jackson-databindmavenNot reported3.2.1Not reportedGHSA-5GVW-P9QM-JGWHNot reported
Mavencom.fasterxml.jackson.core:jackson-databindmavenNot reported2.18.9Not reportedNot reportedNot reported
Mavencom.fasterxml.jackson.core:jackson-databindmavenNot reported2.22.1Not reportedNot reportedNot reported
Maventools.jackson.core:jackson-databindmavenNot reported3.2.1Not reportedNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjackson2-databind-java]Not affected

    Source package: [jackson-databind]

    Details (4)

    • 2.14.0-1+deb12u1 · all · bookworm

      Not affected

      nvd · jackson-databind · debian · bookworm

    • 2.14.0-1+deb12u1 · all · bookworm

      Not affected

      nvd · jackson-databind · debian · bookworm

    • 2.14.0-1+deb12u1 · all · bookworm-security

      Not affected

      nvd · jackson-databind · debian · bookworm

    • 2.14.0-1+deb12u1 · all · bookworm-security

      Not affected

      nvd · jackson-databind · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]