jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Priority LOW 35CWE-915Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 5 fixed, 31 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-915.
Summary
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Fix Partial jackson-databind (FasterXML): 2.18.8, 2.21.4, 3.1.4com.fasterxml.jackson.core:jackson-databind (Maven): 2.18.8, 2.21.4+1 more productRed Hat: 6 advisoriesRed Hat: 5 fixed, 31 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FasterXML | jackson-databind | 2.15.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 | 2.18.8, 2.21.4, 3.1.4 | Patch available | CNA |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.15.0 to before 2.18.8 | 2.18.8 | Patch available | GHSA-3pjw-73gf-8qr5 |
| — | com.fasterxml.jackson.core:jackson-databind (Maven) | 2.19.0 to before 2.21.4 | 2.21.4 | Patch available | GHSA-3pjw-73gf-8qr5 |
| — | tools.jackson.core:jackson-databind (Maven) | 3.0.0 to before 3.1.4 | 3.1.4 | Patch available | GHSA-3pjw-73gf-8qr5 |
- jackson-databind VendorFasterXML Affected 2.15.0 to before 2.18.8; 2.19.0 to before 2.21.4; 3.0.0 to before 3.1.4 Fixed in 2.18.8, 2.21.4, 3.1.4 Patch available CNA
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.15.0 to before 2.18.8 Fixed in 2.18.8 Patch available GHSA-3pjw-73gf-8qr5
- com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.4 Fixed in 2.21.4 Patch available GHSA-3pjw-73gf-8qr5
- tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.4 Fixed in 3.1.4 Patch available GHSA-3pjw-73gf-8qr5
Remediation
- Fix · CNA jackson-databind (FasterXML) Fixed in 2.18.8, 2.21.4, 3.1.4
- Fix · GHSA-3pjw-73gf-8qr5 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.8 Advisory →
- Fix · GHSA-3pjw-73gf-8qr5 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.4 Advisory →
- Fix · GHSA-3pjw-73gf-8qr5 tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.4 Advisory →
Red Hat 6 advisories
- RHSA-2026:76043 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.7 security update
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/disk-image-cuda-rhel9
- RHSA-2026:76041 Released 2026-10-05 · Red Hat rating ImportantRed Hat Enterprise Linux AI 3.3.7 security update
- Red Hat Enterprise Linux AI 3.3 registry.redhat.io/rhelai3/bootc-aws-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-cuda-rhel9, registry.redhat.io/rhelai3/bootc-azure-rocm-rhel9 +3
- RHSA-2026:68699 Released 2026-09-17 · Red Hat rating ImportantRed Hat AI Inference Server 3.3.7 (CUDA)
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-cuda-rhel9
Show 3 more Red Hat advisories
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:54440 Released 2026-08-12 · Red Hat rating ImportantRed Hat Lightspeed (formerly Insights) for Runtimes security update
- Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| OpenShift Developer Tools and Services | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat AMQ Clients | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Build of Keycloak | Affected | No fix yet: Fix deferred |
| Red Hat Certificate System 10 | Affected | No fix yet: Fix deferred |
| Red Hat Certificate System 11 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) 3 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Web Server 7 | Affected | No fix yet: Fix deferred |
| Red Hat Offline Knowledge Portal | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel 4 for Quarkus 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Debezium 3 | Affected | No fix yet: Fix deferred |
| Red Hat build of Quarkus | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 2 | Affected | No fix yet: Fix deferred |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server 3.3 | Fixed | RHSA-2026:68699 |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat Enterprise Linux AI 3.3 | Fixed | RHSA-2026:76041, RHSA-2026:76043 |
| Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 | Fixed | RHSA-2026:54440 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
Not affected: 2 products
- Red Hat Enterprise Linux AI 3.3
- Red Hat OpenShift Dev Spaces 3.30
Timeline
- 2026-10-02 Threatist record created from CVE-2026-59888
- 2026-10-03 Alias added: GHSA-3pjw-73gf-8qr5
- 2026-10-06 Fix available: RHSA-2026:76043 · Red Hat
- 2026-10-06 Fix available: RHSA-2026:76041 · Red Hat
- 2026-10-06 Fix available: Red Hat Enterprise Linux AI 3.3 · Red Hat
- 2026-10-16 Affected versions changed · Red Hat
References
Other 5
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5
- https://github.com/FasterXML/jackson-databind/pull/5974
- https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4
- https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d
- https://github.com/FasterXML/jackson-databind
More FasterXML vulnerabilities
- TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
- TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
- TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
- TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
- TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
- TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
Sources
- CVE-2026-59888 · CVE Program
- CVE-2026-59888 · NVD
- FIRST EPSS
- GHSA-3pjw-73gf-8qr5 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-59888 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences