CVE-2026-59888 Overview
CVE-2026-59888 affects jackson-databind, the general-purpose data-binding library for the Jackson Data Processor. Java Records deserialized with a PropertyNamingStrategy can bypass the @JsonIgnore annotation. The flaw allows attacker-controlled JSON keys to be assigned to Record constructor parameters that developers intended to exclude from deserialization. Affected versions include releases from 2.15.0 up to but not including 2.18.8, 2.21.4, and 3.1.4. The issue is tracked as [CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes].
Critical Impact
Attackers can populate Record fields protected by @JsonIgnore, leading to unintended state assignment during deserialization and potential integrity or confidentiality impact in applications parsing untrusted JSON.
Affected Products
- FasterXML jackson-databind 2.15.0 through versions prior to 2.18.8
- FasterXML jackson-databind 2.19.x and 2.20.x through versions prior to 2.21.4
- FasterXML jackson-databind 3.0.x and 3.1.x through versions prior to 3.1.4
Discovery Timeline
- 2026-07-14 - CVE-2026-59888 published to the National Vulnerability Database (NVD)
- 2026-07-15 - Last updated in NVD database
Technical Details for CVE-2026-59888
Vulnerability Analysis
The defect resides in POJOPropertiesCollector._removeUnwantedIgnorals() inside jackson-databind. When a Java Record type is bound with a configured PropertyNamingStrategy, the collector registers an ignored component under its original implicit property name. The subsequent call to _renameUsing() then applies the naming strategy and produces a renamed JSON key. Because the ignore list was keyed on the original name, the renamed key is not matched against the ignore set. As a result, JSON input containing the renamed key is bound to the Record constructor parameter that the developer marked with @JsonIgnore.
The practical impact is a silent bypass of an access-control annotation used to isolate sensitive Record components. Applications that accept JSON from untrusted sources and rely on @JsonIgnore to shield fields such as internal flags, role identifiers, or audit metadata can be manipulated by attackers who submit the renamed property name.
Root Cause
The root cause is an ordering bug between ignore-tracking and property renaming. _removeUnwantedIgnorals() runs before _renameUsing(), so the ignore set stores implicit names while property matching later occurs against renamed names. The mismatch breaks the invariant that @JsonIgnore annotations suppress binding regardless of naming strategy.
Attack Vector
An attacker delivers crafted JSON to any endpoint that deserializes a Java Record with jackson-databind and a non-default PropertyNamingStrategy (for example SNAKE_CASE or KEBAB_CASE). The attacker supplies the renamed form of an ignored property. Deserialization completes successfully with the ignored component populated from attacker input. No authentication or user interaction is required if the target endpoint accepts unauthenticated JSON.
// Patch reference from release-notes/VERSION
#5974: `@JsonIgnore` on Record property ignored with `PropertyNamingStrategy`
(fixed by Omkhar A)
3.1.3 (01-May-2026)
Source: FasterXML/jackson-databind commit baa2cdf
// Backport into 2.18.8 (release-notes/VERSION-2.x)
#5974: `@JsonIgnore` on Record property ignored with `PropertyNamingStrategy`
(reported by Omkhar A)
2.18.7 (24-Apr-2026)
Source: FasterXML/jackson-databind commit c7c6783
Detection Methods for CVE-2026-59888
Indicators of Compromise
- Inbound JSON payloads containing property names that match the renamed form of Record components annotated with @JsonIgnore.
- Application logs showing successful deserialization of Records where ignored fields hold non-default values.
- Dependency manifests (pom.xml, build.gradle) referencing jackson-databind versions between 2.15.0 and 2.18.7, 2.19.x–2.21.3, or 3.0.x–3.1.3.
Detection Strategies
- Run software composition analysis (SCA) across build artifacts and container images to enumerate vulnerable jackson-databind versions.
- Add code-review rules that flag Java Records combined with PropertyNamingStrategy and @JsonIgnore on constructor parameters.
- Instrument deserialization paths to log when previously-ignored Record components receive non-null values from JSON input.
Monitoring Recommendations
- Correlate web application firewall (WAF) telemetry with backend deserialization events to catch renamed-key injection attempts.
- Track outbound behavior from services that consume untrusted JSON, watching for anomalous state changes tied to formerly-hidden fields.
- Ingest dependency inventory into your data lake to alert whenever a vulnerable jackson-databind version reappears in production.
How to Mitigate CVE-2026-59888
Immediate Actions Required
- Upgrade jackson-databind to 2.18.8, 2.21.4, or 3.1.4 depending on your release branch.
- Audit all Java Records deserialized from untrusted input that use a PropertyNamingStrategy and any @JsonIgnore annotations.
- Rebuild and redeploy container images and shaded JARs that bundle vulnerable versions of the library.
Patch Information
FasterXML fixed the flaw in jackson-databind versions 2.18.8, 2.21.4, and 3.1.4. The fix reorders ignore tracking so that _removeUnwantedIgnorals() accounts for the naming strategy applied by _renameUsing(). Full details are available in the GitHub Security Advisory GHSA-3pjw-73gf-8qr5 and Pull Request #5974.
Workarounds
- Remove PropertyNamingStrategy from ObjectMapper instances that deserialize Records containing @JsonIgnore components until patching is complete.
- Replace Records with classic POJOs using explicit setters and access modifiers for sensitive fields on affected code paths.
- Add server-side validation that rejects JSON keys corresponding to renamed ignored properties before deserialization occurs.
# Maven upgrade example
mvn versions:use-dep-version -Dincludes=com.fasterxml.jackson.core:jackson-databind -DdepVersion=2.18.8 -DforceVersion=true
# Gradle upgrade example
./gradlew dependencyInsight --dependency jackson-databind
# then pin in build.gradle:
# implementation 'com.fasterxml.jackson.core:jackson-databind:2.18.8'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
