CVE-2026-59888 jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
Attackers can bypass @JsonIgnore annotations on Java Record properties when using PropertyNamingStrategy, potentially exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-59888?
CVE-2026-59888 is a medium-severity vulnerability in FasterXML jackson-databind, published on 14 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
Weakness: CWE-915
Which versions are affected by CVE-2026-59888?
6 open source packages ship an affected version, including com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind.
| Package | Affected | Fixed in |
|---|---|---|
com.fasterxml.jackson.core:jackson-databind Maven | From 2.15.0 | 2.18.8 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.15.0 | 2.18.8 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.4 |
com.fasterxml.jackson.core:jackson-databind Maven | From 2.19.0 | 2.21.4 |
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.4 |
tools.jackson.core:jackson-databind Maven | From 3.0.0 | 3.1.4 |
How do I fix CVE-2026-59888?
Upgrade com.fasterxml.jackson.core:jackson-databind to a fixed version for your release line: 2.18.8 or 2.21.4.
Is CVE-2026-59888 being exploited?
There is no known exploitation of CVE-2026-59888 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-EW05090, CLEANSTART-2026-GQ65848, CLEANSTART-2026-OI38839, CLEANSTART-2026-OJ07374, CLEANSTART-2026-OU70021, CLEANSTART-2026-QO27706 and 127 more.