{"id":"CVE-2026-59889","summary":"jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization","details":"jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.","aliases":["GHSA-5gvw-p9qm-jgwh"],"modified":"2026-10-28T11:14:37.194535090Z","published":"2026-07-14T19:57:48.473Z","related":["SUSE-SU-2026:22822-1","SUSE-SU-2026:3273-1","openSUSE-SU-2026:11279-1","openSUSE-SU-2026:21375-1"],"database_specific":{"cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json","cna_assigner":"GitHub_M"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json"},{"type":"ADVISORY","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59889"},{"type":"REPORT","url":"https://github.com/FasterXML/jackson-databind/issues/6060"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b"},{"type":"FIX","url":"https://github.com/FasterXML/jackson-databind/pull/6056"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/fasterxml/jackson-databind","events":[{"introduced":"9af5904b805fa07a00757fe2d24c1f931b502254"},{"fixed":"f7b3266eb21a232b35520d31ce5e304beb8f1c7c"},{"introduced":"f644a920f4ac768797edf7709070411837c83ef8"},{"fixed":"09b89813cde3c8a56c696b5b5fb415fa4a1f1d51"},{"introduced":"ed2541fedfc6005fd249343f01e6090c8c3395f6"},{"fixed":"446f4ce26371980a5634cf47fedc376b5e411ac6"},{"introduced":"d51183e4fa171235bcd31c63268c5ad1745afb8c"},{"fixed":"a4f1f5e2b7bfce0ca55db9d4769de98fa911df83"},{"introduced":"0f45333297a3d0504f2706c2aff2177586150d25"},{"fixed":"5d74e874671faef1d786cd6d25abfd02daa4c682"},{"fixed":"d627a8a86fcb062429282f79f3f256f181ed2c7b"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"2.0.0-RC1"},{"fixed":"2.18.9"}]},{"range":[{"introduced":"2.19.0"},{"fixed":"2.21.5"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"strategy":"StringRangeExpression","range":[{"introduced":"2.22.0"},{"fixed":"2.22.1"}],"source":"AFFECTED_FIELD"},{"strategy":"StringRangeExpression","range":[{"introduced":"3.0.0"},{"fixed":"3.1.5"}],"source":"AFFECTED_FIELD"},{"range":[{"introduced":"3.2.0"},{"fixed":"3.2.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d627a8a86fcb062429282f79f3f256f181ed2c7b"}]}]}}],"versions":["jackson-databind-3.2.0","jackson-databind-2.22.0","jackson-databind-3.1.4","jackson-databind-2.21.4","jackson-databind-2.18.8","jackson-databind-3.1.3","jackson-databind-2.21.3","jackson-databind-2.18.7","jackson-databind-3.1.2","jackson-databind-3.1.1","jackson-databind-2.21.2","jackson-databind-3.1.0","jackson-databind-2.21.1","jackson-databind-2.18.6","jackson-databind-3.1.0-rc1","jackson-databind-2.21.0","jackson-databind-2.18.5","jackson-databind-3.0.1","jackson-databind-3.0.0","jackson-databind-2.20.0","jackson-databind-2.20.0-rc1","jackson-databind-2.18.4","jackson-databind-2.19.0","jackson-databind-2.18.3","jackson-databind-2.18.2","jackson-databind-2.18.1","jackson-databind-2.18.0","jackson-databind-2.18.0-rc1","jackson-databind-2.17.0-rc1","jackson-databind-2.16.0","jackson-databind-2.16.0-rc1","jackson-databind-2.15.0","jackson-databind-2.15.0-rc3","jackson-databind-2.15.0-rc2","jackson-databind-2.15.0-rc1","jackson-databind-2.14.0","jackson-databind-2.14.0-rc3","jackson-databind-2.14.0-rc2","jackson-databind-2.14.0-rc1","jackson-databind-2.13.0","jackson-databind-2.13.0-rc2","jackson-databind-2.13.0-rc1","jackson-databind-2.12.1","jackson-databind-2.12.0","jackson-databind-2.12.0-rc2","jackson-databind-2.12.0-rc1","jackson-databind-2.11.0","jackson-databind-2.11.0.rc1","jackson-databind-2.10.0","jackson-databind-2.10.0.pr3","jackson-databind-2.10.0.pr2","jackson-databind-2.10.0.pr1","jackson-databind-2.9.6","jackson-databind-2.9.5","jackson-databind-2.9.4","jackson-databind-2.9.3","jackson-databind-2.9.1","jackson-databind-2.9.0","jackson-databind-2.9.0.pr4","jackson-databind-2.9.0.pr3","jackson-databind-2.9.0.pr2","jackson-databind-2.9.0.pr1","jackson-databind-2.8.2","jackson-databind-2.8.1","jackson-databind-2.8.0","jackson-databind-2.7.1-1","jackson-databind-2.7.1","jackson-databind-2.7.0","jackson-databind-2.7.0-rc3","jackson-databind-2.7.0-rc2","jackson-databind-2.7.0-rc1","jackson-databind-2.6.1","jackson-databind-2.6.0","jackson-databind-2.6.0-rc4","2.6.0-rc3b","jackson-databind-2.6.0-rc1","jackson-databind-2.5.0","jackson-databind-2.5.0-rc1","jackson-databind-2.4.1.3","jackson-databind-2.4.1.2","jackson-databind-2.4.1.1","jackson-databind-2.4.1","jackson-databind-2.4.0","jackson-databind-2.4.0-rc3","jackson-databind-2.4.0-rc2","jackson-databind-2.4.0-rc1","jackson-databind-2.3.1","jackson-databind-2.3.0","jackson-databind-2.3.0-rc1","jackson-databind-2.2.2","jackson-databind-2.2.1","2.2.0c","jackson-databind-2.2.0","jackson-databind-2.1.1","jackson-databind-2.1.0","jackson-databind-2.0.2","jackson-databind-2.0.1","jackson-databind-2.0.0","jackson-databind-2.0.0-RC3","jackson-databind-2.0.0-RC2","jackson-databind-2.0.0-RC1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59889.json","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"38219315850865968457985822492614804225","length":355},"id":"CVE-2026-59889-6fa09bb3","signature_type":"Function","signature_version":"v1","source":"https://github.com/fasterxml/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","target":{"file":"src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java","function":"processUnwrapped"}},{"source":"https://github.com/fasterxml/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b","target":{"file":"src/main/java/com/fasterxml/jackson/databind/deser/impl/UnwrappedPropertyHandler.java"},"deprecated":false,"digest":{"line_hashes":["69111130285733665845842448509825191069","131745598759607440769632991380110159691","227038717324575151299858168555311193390","70431490580368147867302567538728532153","109037359334413101786264361763256054936","39558650246812817006721738270444780294"],"threshold":0.9},"id":"CVE-2026-59889-7420522f","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-28T11:14:37Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}