CVE-2026-59888

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.15.0 through 2.18.7 jackson-databind versions 2.21.0 through 2.21.3 jackson-databind versions 3.1.0 through 3.1.3

Description Java Records using a PropertyNamingStrategy can bypass the @JsonIgnore annotation. This occurs because the POJOPropertiesCollector. removeUnwantedIgnorals() function records an ignored component using its original implicit name before the renameUsing() function applies the naming strategy. Consequently, the renamed JSON key can be assigned to the Record constructor parameter.

Recommendations Update to version 2.18.8 Update to version 2.21.4 Update to version 3.1.4