Jackson Databind v2.15-2.18.8 Vulnerable to @JsonIgnore Bypass via Records
CVE-2026-59888 Published on July 14, 2026
jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.
Vulnerability Analysis
CVE-2026-59888 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a Mass Assignment Vulnerability?
The software receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
CVE-2026-59888 has been classified to as a Mass Assignment vulnerability or weakness.
Products Associated with CVE-2026-59888
Want to know whenever a new CVE is published for FasterXML Jackson Databind? stack.watch will email you.
Affected Versions
FasterXML jackson-databind:- Version >= 2.15.0, < 2.18.8 is affected.
- Version >= 2.19.0, < 2.21.4 is affected.
- Version >= 3.0.0, < 3.1.4 is affected.