Jackson Databind Java Record PropertyNamingStrategy Bypass

Executive Summary

CVE-2026-59888 is a vulnerability in the jackson-databind library, which is used for data-binding and JSON processing in Java applications. The issue specifically affects Java Records when a PropertyNamingStrategy is applied.

The vulnerability occurs because the @JsonIgnore annotation, which is meant to exclude a property from serialization or deserialization, is bypassed when a PropertyNamingStrategy renames the property. For example, if a property named 'internalRole' is annotated with @JsonIgnore and a SnakeCase naming strategy is applied, the property would be renamed to 'internal_role' in the JSON. However, the deserialization process incorrectly processes the renamed property, allowing it to be set despite the @JsonIgnore annotation.

This flaw was introduced in version 2.15.0 and affects versions up to 2.18.7, 2.21.3, and 3.1.3. The issue was fixed in versions 2.18.8, 2.21.4, and 3.1.4, ensuring that @JsonIgnore semantics are preserved even when property names are transformed by a naming strategy.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of jackson-databind with Java Records and a PropertyNamingStrategy. Since the issue is related to deserialization behavior, you cannot directly detect it via network scans or simple commands. Instead, focus on identifying the library versions and code patterns.

• Check the version of jackson-databind in your project dependencies. The vulnerable versions are 2.15.0 to 2.18.7, 2.19.0 to 2.21.3, and 3.0.0 to 3.1.3. You can use build tools like Maven or Gradle to list dependencies.
• For Maven, run: mvn dependency:tree | grep jackson-databind to identify the version.
• For Gradle, run: gradle dependencies | grep jackson-databind to check the version.
• Review your codebase for Java Records that use @JsonIgnore annotations alongside a PropertyNamingStrategy (e.g., SnakeCaseStrategy). The vulnerability manifests when these two conditions are met.
• Test deserialization behavior by crafting JSON input with renamed keys (e.g., snake_case) for properties annotated with @JsonIgnore. If the property is set despite the annotation, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you if your application uses jackson-databind to deserialize JSON data into Java Records and relies on the @JsonIgnore annotation to exclude sensitive or internal properties from being set by untrusted input.

• Exposure of sensitive data: If a property annotated with @JsonIgnore is intended to remain private or internal, the vulnerability could allow an attacker to set this property via its renamed JSON key, potentially exposing or manipulating sensitive data.
• Security bypass: The vulnerability could enable an attacker to bypass security controls that depend on the @JsonIgnore annotation, such as excluding privileged fields from being modified by external input.
• Data integrity issues: If the ignored property is critical for the application's logic, its unintended modification could lead to unexpected behavior or data corruption.

The impact is classified as moderate with a CVSS score of 6.5, indicating that it could lead to low confidentiality and integrity impacts if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could affect compliance with common standards and regulations, depending on how your application handles sensitive or protected data.

• GDPR (General Data Protection Regulation): If the vulnerability allows unauthorized access to or modification of personal data, it could lead to a violation of GDPR principles, such as data protection by design and default (Article 25) or the requirement to implement appropriate security measures (Article 32). A breach involving personal data could also trigger reporting obligations under Article 33.
• HIPAA (Health Insurance Portability and Accountability Act): For applications handling protected health information (PHI), this vulnerability could result in unauthorized access to or modification of PHI, violating the HIPAA Security Rule (45 CFR Part 164, Subpart C). This could lead to non-compliance with requirements for safeguarding electronic PHI.
• Other standards: The vulnerability may also impact compliance with standards like PCI DSS (Payment Card Industry Data Security Standard) if it involves payment card data, or other industry-specific regulations that require strict control over data access and modification.

The vulnerability is classified under CWE-915, which involves improperly controlled modification of dynamically determined object attributes. This could be seen as a failure to implement adequate access controls, a common requirement across many compliance frameworks.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate CVE-2026-59888, follow these steps immediately:

• Upgrade jackson-databind to a patched version. The fixed versions are 2.18.8, 2.21.4, or 3.1.4. This is the most reliable way to resolve the issue.
• If upgrading is not immediately possible, avoid using PropertyNamingStrategy with Java Records that have @JsonIgnore annotations. Temporarily remove or refactor such code to prevent the bypass.
• Add input validation to ensure that JSON keys matching renamed versions of ignored properties are rejected during deserialization. This can act as a temporary safeguard.
• Monitor deserialization processes for unexpected property assignments, especially in records with @JsonIgnore annotations. Log or block such cases until the patch is applied.
• Review and audit all Java Records in your codebase that use @JsonIgnore and PropertyNamingStrategy to identify potential exposure. Prioritize records handling sensitive or privileged data.

Useful 0 Not Useful 0