CVE-2026-59888: jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Summary For Java Records, POJOPropertiesCollector.removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before renameUsing() applies the PropertyNamingStrategy. After the rename, ignoredPropertyNames still holds only the pre-rename name, so ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.
Impact A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).
Affected / Patched (verified via git tag --contains) - 2.15-2.18 line: >= 2.15.0, < 2.18.8 -> fixed in 2.18.8 (backport c7c6783) - 2.19-2.21 line: >= 2.19.0, < 2.21.4 -> fixed in 2.21.4 - 3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5974, baa2cdf)
Severity / CWE Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.
Credits Omkhar Arasaratnam (@omkhar) - finder.
Other sources
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector.removeUnwantedIgnorals() records an ignored component under its original implicit name before renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/tools.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.4 - Upgrade
Upgrade
maven/com.fasterxml.jackson.core:jackson-databindto a version that resolves this vulnerability.Fixed in 2.18.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.18.8 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 2.21.4 - Upgrade
Upgrade
jackson-databindto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59888?
The severity of CVE-2026-59888 is rated as medium with a base score of 6.5.
How do I fix CVE-2026-59888?
To mitigate CVE-2026-59888, upgrade jackson-databind to versions 2.18.9, 2.21.5, or 3.1.5 or later.
What software is affected by CVE-2026-59888?
CVE-2026-59888 affects jackson-databind versions from 2.15.0 until 2.18.8, 2.21.4, and 3.1.4.
What does CVE-2026-59888 exploit?
CVE-2026-59888 exploits the @JsonIgnore annotation on Java Record properties when using a PropertyNamingStrategy.
When was CVE-2026-59888 published?
CVE-2026-59888 was published on July 14, 2026.