CVE-2026-59889
published 2026-07-14CVE-2026-59889: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNIHAN
EPSS
0.39%
31.4th percentile
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
Affected
80 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-24 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| candlepinproject | candlepin | — | — |
| debian | ceph | — | — |
| debian | dogtag-pki | — | — |
| debian | puppetserver | — | — |
| devspaces | multicluster-redirector-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| devspaces | server-rhel9 | — | — |
| exploit-intelligence | agent-client-rhel9 | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | — | — |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
vendor_redhat·2026-07-14·CVSS 6.5
CVE-2026-59889 [MEDIUM] CWE-915 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
A flaw was found in jackson-databind. The UnwrappedPropertyHandler.processUnwrapped()
GHSA
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
ghsa·2026-07-21
CVE-2026-59889 [MEDIUM] CWE-863 jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization
## Summary
`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** — the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.
**Correction to the original framing (runtime-verified):** the gap
VulDB
FasterXML jackson-databind up to 3.2.0 UnwrappedPropertyHandler UnwrappedPropertyHandler.processUnwrapped view deserialization
vuldb·2026-07-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] FasterXML jackson-databind up to 3.2.0 UnwrappedPropertyHandler UnwrappedPropertyHandler.processUnwrapped view deserialization
A vulnerability, which was classified as critical, was found in FasterXML jackson-databind up to 2.18.8/2.21.4/2.22.0/3.1.4/3.2.0. Impacted is the function UnwrappedPropertyHandler.processUnwrapped of the component UnwrappedPropertyHandler. The manipulation of the argument view results in deserialization.
This vulnerability is cataloged as CVE-2026-59889. The attack may be launched remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-59889 jetty: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 jetty: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 jetty: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written f
Bugzilla
CVE-2026-59889 ceph: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 ceph: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 ceph: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written fr
Bugzilla
CVE-2026-59889 python-avro: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 python-avro: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 python-avro: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be wri
Bugzilla
CVE-2026-59889 jackson-bom: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 jackson-bom: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 jackson-bom: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be wri
Bugzilla
CVE-2026-59889 google-gson: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 google-gson: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 google-gson: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be wri
Bugzilla
CVE-2026-59889 google-gson: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [epel-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 google-gson: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [epel-all]
CVE-2026-59889 google-gson: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be writt
Bugzilla
CVE-2026-59889 log4j: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 log4j: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 log4j: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written f
Bugzilla
CVE-2026-59889 dogtag-pki: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 dogtag-pki: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 dogtag-pki: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be writ
Bugzilla
CVE-2026-59889 byte-buddy: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
bugzilla·2026-10-15·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 byte-buddy: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
CVE-2026-59889 byte-buddy: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be writ
Bugzilla
CVE-2026-59889 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
bugzilla·2026-07-14·CVSS 6.5
CVE-2026-59889 [MEDIUM] CVE-2026-59889 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
CVE-2026-59889 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.
2026-07-14
Published