CVE-2026-59889: jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-14 · updated 2026-10-24
Weakness: CWE-863

Description

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.

Affected products

Maven Com.Fasterxml.Jackson.Core:Jackson-Databind: from 2.19.0 before 2.21.5; from 2.0.0-RC1 before 2.18.9; from 2.22.0 before 2.22.1; 2.19.0, 2.19.1, 2.19.2, 2.19.3, 2.19.4, 2.20.0 (+219) — fixed in 2.21.5, 2.18.9, 2.22.1
Maven Tools.Jackson.Core:Jackson-Databind: from 3.0.0 before 3.1.5; from 3.2.0 before 3.2.1; 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.1.0 (+6) — fixed in 3.1.5, 3.2.1
FasterXML jackson-databind: from 2.0.0-RC1, < 2.18.9; from 2.19.0, < 2.21.5; from 2.22.0, < 2.22.1; from 3.0.0, < 3.1.5; from 3.2.0, < 3.2.1

How to fix

Upgrade to a fixed version: Maven Com.Fasterxml.Jackson.Core:Jackson-Databind 2.21.5, 2.18.9, 2.22.1; Maven Tools.Jackson.Core:Jackson-Databind 3.1.5, 3.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-59889 or the next vulnerability affects your stack