CVE-2026-59889

Name of the Vulnerable Software and Affected Versions jackson-databind versions 2.18.0 through 2.18.8 jackson-databind versions 2.21.0 through 2.21.4 jackson-databind versions 2.22.0 through 2.22.0 jackson-databind versions 3.1.0 through 3.1.4 jackson-databind versions 3.2.0 through 3.2.0

Description The UnwrappedPropertyHandler.processUnwrapped() function replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard. This allows a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker-controlled JSON even when a less-privileged active view is in use.

Recommendations Update to version 2.18.9 Update to version 2.21.5 Update to version 2.22.1 Update to version 3.1.5 Update to version 3.2.1