CVE-2026-59889

MEDIUM

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

Title source: cna
STIX 2.1

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

References (4)

Core 4

Scores

CVSS v3 6.5
EPSS 0.0035
EPSS Percentile 27.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (10)
com.fasterxml.jackson.core/jackson-databind 2.18.0 - 2.18.9Maven
com.fasterxml.jackson.core/jackson-databind 2.21.0 - 2.21.5Maven
com.fasterxml.jackson.core/jackson-databind 2.22.0 - 2.22.1Maven
FasterXML/jackson-databind >= 2.18.0, < 2.18.9
FasterXML/jackson-databind >= 2.21.0, < 2.21.5
FasterXML/jackson-databind >= 2.22.0, < 2.22.1
FasterXML/jackson-databind >= 3.0.0, < 3.1.5
FasterXML/jackson-databind >= 3.2.0, < 3.2.1
tools.jackson.core/jackson-databind 3.0.0 - 3.1.5Maven
tools.jackson.core/jackson-databind 3.2.0 - 3.2.1Maven
Published Jul 14, 2026
Tracked Since Jul 15, 2026