Data-Binding Vulnerability in Jackson Databind Software by FasterXML
CVE-2026-59889
6.5MEDIUM
What is CVE-2026-59889?
A flaw in the Jackson Databind library allows JSON properties annotated with both @JsonView and @JsonUnwrapped to be manipulated by attacker-controlled JSON. This occurs due to insufficient guarding in the process of deserializing properties, exposing applications to unauthorized data access under a less-privileged active view. This vulnerability is addressed in the subsequent software releases, ensuring broader protection against such potential exploits.
Affected Version(s)
jackson-databind >= 2.18.0, < 2.18.9 < 2.18.0, 2.18.9
jackson-databind >= 2.21.0, < 2.21.5 < 2.21.0, 2.21.5
jackson-databind >= 2.22.0, < 2.22.1 < 2.22.0, 2.22.1