Skip to content
Fencer Vulns
medium 6.5

CVE-2026-59889 json

jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

published 2026-07-14 3 mo ago modified 2026-10-24 15 d ago also GHSA-5gvw-p9qm-jgwh , EUVD-2026-44506

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Patch / fix

  • maven com.fasterxml.jackson.core:jackson-databind 2.18.9, 2.21.5, 2.22.1
  • maven tools.jackson.core:jackson-databind 3.1.5, 3.2.1
  • eap8-jaxb jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-txw2 jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-xsom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-log4j jboss enterprise application platform 8.1 2.25.4-1.redhat_00003.1.el10eap
  • eap8-netty jboss enterprise application platform 8.1 4.1.136-1.Final_redhat_00001.1.el10eap
  • eap8-rngom jboss enterprise application platform 8.1 4.0.7-4.redhat_00001.1.el10eap
  • eap8-slf4j jboss enterprise application platform 8.1 2.0.18-1.redhat_00001.1.el10eap
  • eap8-neethi jboss enterprise application platform 8.1 3.2.2-1.redhat_00001.1.el10eap

red hat advisories RHSA-2026:70230RHSA-2026:70229RHSA-2026:70228RHSA-2026:67604

  • jackson-core SLE Module for Basesystem 15 SP7 2.18.9-150200.3.25.1
  • jackson-databind SLE Module for Basesystem 15 SP7 2.18.9-150200.3.33.1
  • jackson-annotations SLE Module for Basesystem 15 SP7 2.18.9-150200.3.25.1
  • jackson-dataformats-binary SLE Module for Development Tools 15 SP7 2.18.9-150200.3.24.1
  • jackson-databind SLES for SAP applications 16.0, SLES 16.0 2.18.9-160000.1.1
  • jackson-core SLES for SAP applications 16.0, SLES 16.0 2.18.9-160000.1.1
  • jackson-annotations SLES for SAP applications 16.0, SLES 16.0 2.18.9-160000.1.1

suse advisories SUSE-SU-2026:3273-1SUSE-SU-2026:22822-1

  • jackson-databind openSUSE Leap 16.0 2.18.9-160000.1.1
  • jackson-core openSUSE Leap 16.0 2.18.9-160000.1.1
  • jackson-annotations openSUSE Leap 16.0 2.18.9-160000.1.1
  • jackson-databind openSUSE Tumbleweed 2.18.9-2.1

opensuse advisories openSUSE-SU-2026:21375-1openSUSE-SU-2026:11279-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-59889 updated cvss 6.5

com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties

  • Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9 Red Hat OpenShift Developer Tools and Services jenkins, jenkins-2-plugins, ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more Red Hat AI Inference Server rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9 Red Hat AMQ Broker 7 jackson-databind Red Hat Ansible Automation Platform 2 python-drools-jpy-jar, python3x-drools-jpy-jar, python3.11-drools-jpy-jar, python3.12-drools-jpy-jar, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, +5 more
    +28 more products
    Red Hat build of Apache Camel 4 for Quarkus 3 jackson-databind Red Hat build of Apache Camel for Spring Boot 4 jackson-databind Red Hat build of Apicurio Registry 3 jackson-databind Red Hat build of Debezium 3 jackson-databind Red Hat Build of Keycloak jackson-databind, rhbk/keycloak-rhel9, keycloak/rhbk-rhel9-operator, rhbk/keycloak-rhel9-operator, keycloak/rhbk-openshift-rhel9 Red Hat build of Quarkus jackson-databind Red Hat Ceph Storage 6 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 7 ceph, cephadm, librbd1, librgw2, rbd-nbd, ceph-mib, +16 more Red Hat Ceph Storage 8 ceph, cephadm, liborc1, librbd1, librgw2, rbd-nbd, +18 more Red Hat Ceph Storage 9 ceph, liborc, cephadm, liborc2, librbd1, librgw2, +21 more Red Hat Certificate System 10 redhat-pki Red Hat Certificate System 11 redhat-pki Red Hat Data Grid 8 jackson-databind Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-core, pki-tools, +16 more Red Hat Enterprise Linux 10 ceph, dogtag-pki, assertj-core Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9 Red Hat Fuse 7 jackson-databind Red Hat Hardened Images maven3.9 Red Hat JBoss Enterprise Application Platform 7 jackson-databind, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 Red Hat JBoss Enterprise Application Platform 8 jackson-databind Red Hat JBoss Web Server 7 jboss-webserver-7/jws70-openjdk17-openshift-rhel9, jboss-webserver-7/jws70-openjdk17-rhel9-openshift, jboss-webserver-7/jws70-openjdk21-openshift-rhel9, jboss-webserver-7/jws70-openjdk21-rhel9-openshift Red Hat Lightspeed for Runtimes Operator rh-lightspeed-runtimes/runtimes-agent-init-rhel9 Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-modelmesh-rhel9, rhoai/odh-vllm-gaudi-rhel9, rhoai/odh-spark-operator-rhel9, rhoai/odh-trustyai-service-rhel9, rhoai/odh-th-torch-cpu-py312-rhel9, rhoai/odh-th-torch-cuda-py312-rhel9, +20 more Red Hat OpenShift Dev Spaces devspaces/server-rhel9, devspaces/openvsx-rhel9, devspaces/pluginregistry-rhel9, devspaces/multicluster-redirector-rhel9 Red Hat Satellite 6 candlepin, puppetserver, openvox-server, candlepin-selinux Red Hat Single Sign-On 7 jackson-databind
    affected: workaround, no fix available “Fix deferred”
  • Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server eap7-wildfly 7.4.25-6.GA_redhat_00005.1.el7eap, eap7-jackson-core 2.18.9-1.redhat_00003.1.el7eap, eap7-jackson-databind 2.18.9-1.redhat_00003.1.el7eap, eap7-activemq-artemis 2.16.0-23.redhat_00058.1.el7eap, eap7-jackson-jaxrs-base 2.18.9-1.redhat_00003.1.el7eap, eap7-wildfly-modules 7.4.25-6.GA_redhat_00005.1.el7eap, +25 more Red Hat JBoss EAP 7.4 ELS for RHEL 8 eap7-wildfly 7.4.25-6.GA_redhat_00005.1.el8eap, eap7-jackson-core 2.18.9-1.redhat_00003.1.el8eap, eap7-jackson-databind 2.18.9-1.redhat_00003.1.el8eap, eap7-activemq-artemis 2.16.0-23.redhat_00058.1.el8eap, eap7-jackson-jaxrs-base 2.18.9-1.redhat_00003.1.el8eap, eap7-wildfly-modules 7.4.25-6.GA_redhat_00005.1.el8eap, +26 more Red Hat JBoss EAP 7.4 ELS for RHEL 9 eap7-wildfly 7.4.25-6.GA_redhat_00005.1.el9eap, eap7-jackson-core 2.18.9-1.redhat_00003.1.el9eap, eap7-jackson-databind 2.18.9-1.redhat_00003.1.el9eap, eap7-activemq-artemis 2.16.0-23.redhat_00058.1.el9eap, eap7-jackson-jaxrs-base 2.18.9-1.redhat_00003.1.el9eap, eap7-wildfly-modules 7.4.25-6.GA_redhat_00005.1.el9eap, +26 more
    fixed: vendor fix RHSA-2026:67604
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-jaxb 4.0.7-4.redhat_00001.1.el8eap, eap8-txw2 4.0.7-4.redhat_00001.1.el8eap, eap8-xsom 4.0.7-4.redhat_00001.1.el8eap, eap8-rngom 4.0.7-4.redhat_00001.1.el8eap, eap8-log4j 2.25.4-1.redhat_00003.1.el8eap, eap8-neethi 3.2.2-1.redhat_00001.1.el8eap, +101 more
    fixed: vendor fix RHSA-2026:70228
  • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-jaxb 4.0.7-4.redhat_00001.1.el9eap, eap8-txw2 4.0.7-4.redhat_00001.1.el9eap, eap8-xsom 4.0.7-4.redhat_00001.1.el9eap, eap8-rngom 4.0.7-4.redhat_00001.1.el9eap, eap8-log4j 2.25.4-1.redhat_00003.1.el9eap, eap8-neethi 3.2.2-1.redhat_00001.1.el9eap, +101 more
    fixed: vendor fix RHSA-2026:70229
  • Red Hat JBoss EAP 8.1 for RHEL 10 eap8-jaxb 4.0.7-4.redhat_00001.1.el10eap, eap8-txw2 4.0.7-4.redhat_00001.1.el10eap, eap8-xsom 4.0.7-4.redhat_00001.1.el10eap, eap8-rngom 4.0.7-4.redhat_00001.1.el10eap, eap8-log4j 2.25.4-1.redhat_00003.1.el10eap, eap8-neethi 3.2.2-1.redhat_00001.1.el10eap, +100 more
    fixed: vendor fix RHSA-2026:70230

2 more fixed, 3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
3 mo ago

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven com.fasterxml.jackson.core:jackson-databind
>=2.19.0, <2.21.5
>=2.0.0-RC1, <2.18.9
>=2.22.0, <2.22.1
2.21.5
2.18.9
2.22.1
maven tools.jackson.core:jackson-databind
>=3.0.0, <3.1.5
>=3.2.0, <3.2.1
3.1.5
3.2.1

Affected products

  • FasterXML jackson-databind

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.