All vulnerabilities
CVE-2026-59889GHSA-5gvw-p9qm-jgwh

tools.jackson.core:jackson-databind: jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization

FasterXML tools.jackson.core:jackson-databindmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 26% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.1.5Also 2.22.1, 3.2.1 and 2 moreGitHub
Published14 Jul 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3.1.5tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.5</version></dependency>
  • 2.22.1com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.1</version></dependency>
  • 3.2.1tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.1</version></dependency>
  • 2.21.5com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.5</version></dependency>
  • 2.18.9com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.9</version></dependency>
  • 2.21.5com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.5</version></dependency>
Show all 10 fixed versions
  • 3.1.5tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.5</version></dependency>
  • 2.18.9com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.9</version></dependency>
  • 2.22.1com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.1</version></dependency>
  • 3.2.1tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.1</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

UnwrappedPropertyHandler.processUnwrapped() replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet() with **no prop.visibleInView(ctxt.getActiveView()) guard** — the exact guard processUnwrappedCreatorProperties() received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard BeanDeserializer.deserializeWithUnwrapped applies to directly-matched properties. As a result, a property annotated with both @JsonView(PrivilegedView.class) and @JsonUnwrapped is written from attacker JSON even when deserializing under a more-restrictive active view.

Correction to the original framing (runtime-verified): the gap is NOT a per-field inner @JsonView (the unwrapped sub-object's own BeanDeserializer gates inner fields correctly). The unchecked gate is the view of the unwrapped CONTAINER property.

Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)

An @JsonView(AdminView) property that is NOT @JsonUnwrapped → null under PublicView (correctly gated). The identical property WITH @JsonUnwrapped → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.

Impact — write-side mass-assignment / privilege escalation

@JsonView is commonly used as a write-side authorization guard: a public endpoint binds the body under readerWithView(PublicView.class) and groups privileged state in a nested object whose container property is @JsonView(AdminView). When that property is @JsonUnwrapped, an untrusted caller mass-assigns it. PoC: a self-service registration where AccountFlags{role,approved,creditBalance} is @JsonView(AdminView) @JsonUnwrapped; attacker JSON {role:ADMIN,approved:true,creditBalance:1000000} under PublicView binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (C:N/I:H/A:N); no worse than the C:L/I:L parent and arguably higher as @JsonView-as-write-guard is the exact use case #5971/#5969 defended.

Affected

  • com.fasterxml.jackson.core:jackson-databind 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). DEFAULT_VIEW_INCLUSION default=true.
  • tools.jackson.core:jackson-databind 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). DEFAULT_VIEW_INCLUSION default=false → the stock-config repro is the common shape where privileged inner fields are individually @JsonView(PublicView) and the developer relies on the container @JsonView(AdminView); the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)

Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)

  • nested @JsonUnwrapped (unwrapped-in-unwrapped) — recursive bypass.
  • merge / readerWithView(...).withValueToUpdate(...) (PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.
  • builder-based deserializer (@JsonDeserialize(builder=...)) — BuilderBasedDeserializer routes through the same processUnwrapped.
  • Honest non-findings: read-side serialization correctly honors views (no leak); @JsonAnySetter+view and @JsonTypeInfo+@JsonUnwrapped are separate/unsupported behaviors, not this bug.

Fix

Add prop.visibleInView(ctxt.getActiveView()) (when MapperFeature.DEFAULT_VIEW_INCLUSION/active-view applies) to the processUnwrapped() property loop, mirroring processUnwrappedCreatorProperties(). One change closes the impact PoC + all three variants across BeanDeserializer and BuilderBasedDeserializer. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.

Text from GitHub Advisory Database

Affected versions 92

  • tools.jackson.core:jackson-databind, maven>= 3.0.0, <= 3.1.4GitHub
  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.22.0, < 2.22.1GitHub
  • tools.jackson.core:jackson-databind, maven>= 3.2.0, < 3.2.1GitHub
  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.19.0, < 2.21.5GitHub
  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.0.0-RC1, < 2.18.9GitHub
  • jackson-databindaffected: >= 2.0.0-RC1, < 2.18.9CVE List
  • jackson-databindaffected: >= 2.19.0, < 2.21.5CVE List
  • jackson-databindaffected: >= 2.22.0, < 2.22.1CVE List
  • jackson-databindaffected: >= 3.0.0, < 3.1.5CVE List
  • jackson-databindaffected: >= 3.2.0, < 3.2.1CVE List
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.19.0, fixed in 2.21.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.4OSV
  • tools.jackson.core:jackson-databind, Mavenfrom 3.0.0, fixed in 3.1.5OSV
  • tools.jackson.core:jackson-databind, Maven3.0.0OSV
  • tools.jackson.core:jackson-databind, Maven3.0.1OSV
  • tools.jackson.core:jackson-databind, Maven3.0.2OSV
  • tools.jackson.core:jackson-databind, Maven3.0.3OSV
  • tools.jackson.core:jackson-databind, Maven3.0.4OSV
  • tools.jackson.core:jackson-databind, Maven3.1.0OSV
  • tools.jackson.core:jackson-databind, Maven3.1.0-rc1OSV
  • tools.jackson.core:jackson-databind, Maven3.1.1OSV
  • tools.jackson.core:jackson-databind, Maven3.1.2OSV
  • tools.jackson.core:jackson-databind, Maven3.1.3OSV
  • tools.jackson.core:jackson-databind, Maven3.1.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.0.0-RC1, fixed in 2.18.9OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.0-RC1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.0-RC2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.0-RC3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.6OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.5.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.0.rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.6OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.6.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.22.0, fixed in 2.22.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.22.0OSV
  • tools.jackson.core:jackson-databind, Mavenfrom 3.2.0, fixed in 3.2.1OSV
  • tools.jackson.core:jackson-databind, Maven3.2.0OSV

References 6