CVE-2026-59889: jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserialization
(updated )
UnwrappedPropertyHandler.processUnwrapped() replays the buffered JSON for a @JsonUnwrapped property by iterating its properties and calling prop.deserializeAndSet() with no prop.visibleInView(ctxt.getActiveView()) guard — the exact guard processUnwrappedCreatorProperties() received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard BeanDeserializer.deserializeWithUnwrapped applies to directly-matched properties. As a result, a property annotated with both @JsonView(PrivilegedView.class) and @JsonUnwrapped is written from attacker JSON even when deserializing under a more-restrictive active view.
Correction to the original framing (runtime-verified): the gap is NOT a per-field inner @JsonView (the unwrapped sub-object’s own BeanDeserializer gates inner fields correctly). The unchecked gate is the view of the unwrapped CONTAINER property.
References
- github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b
- github.com/FasterXML/jackson-databind/issues/6060
- github.com/FasterXML/jackson-databind/pull/6056
- github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh
- github.com/advisories/GHSA-5gvw-p9qm-jgwh
- nvd.nist.gov/vuln/detail/CVE-2026-59889
Code Behaviors & Features
Detect and mitigate CVE-2026-59889 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →