Data-Binding Vulnerability in Jackson Data Processor Affecting Java Records
CVE-2026-59888
6.5MEDIUM
What is CVE-2026-59888?
The data-binding functionality in Jackson Data Processor has a vulnerability that allows Java Records utilizing a PropertyNamingStrategy to bypass the @JsonIgnore annotation. This occurs because the mechanism used to remove ignored components, namely POJOPropertiesCollector._removeUnwantedIgnorals(), records the ignored component under its original name prior to the renaming process. As a result, the renamed JSON key can still be assigned to the respective Record's constructor parameter. This flaw was rectified in the specified versions: 2.18.8, 2.21.4, and 3.1.4.
Affected Version(s)
jackson-databind >= 2.15.0, < 2.18.8 < 2.15.0, 2.18.8
jackson-databind >= 2.19.0, < 2.21.4 < 2.19.0, 2.21.4
jackson-databind >= 3.0.0, < 3.1.4 < 3.0.0, 3.1.4