CVE-2026-59888
ADVISORY - githubSummary
Summary
For Java Records, POJOPropertiesCollector._removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before _renameUsing() applies the PropertyNamingStrategy. After the rename, _ignoredPropertyNames still holds only the pre-rename name, so _ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.
Impact
A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).
Affected / Patched (verified via git tag --contains)
- 2.15-2.18 line:
>= 2.15.0, < 2.18.8-> fixed in 2.18.8 (backportc7c6783) - 2.19-2.21 line:
>= 2.19.0, < 2.21.4-> fixed in 2.21.4 - 3.x line:
>= 3.0.0, < 3.1.4-> fixed in 3.1.4 (#5974,baa2cdf)
Severity / CWE
Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.
Credits
Omkhar Arasaratnam (@omkhar) - finder.
Common Weakness Enumeration (CWE)
Improperly Controlled Modification of Dynamically-Determined Object Attributes
GitHub
3.9
CVSS SCORE
6.5mediumDebian
-
CVSS SCORE
N/AlowUbuntu
-
CVSS SCORE
N/AmediumChainguard
CGA-26p9-w832-5q9c
-
minimos
MINI-23jj-c777-pv67
-
minimos
MINI-2mr7-w6fj-vpj8
-
minimos
MINI-2q46-rww7-qr6f
-
minimos
MINI-2qr8-cqg7-f84c
-
minimos
MINI-2w9g-28vj-78fh
-
minimos
MINI-2xrc-x2v2-frfg
-
minimos
MINI-2xv6-548p-frgv
-
minimos
MINI-39j8-xp9j-6q45
-
minimos
MINI-3cch-ghp8-253v
-
minimos
MINI-4vcf-g72j-r4wg
-
minimos
MINI-4w23-mjw7-hm2g
-
minimos
MINI-53rc-8vvh-p9xv
-
minimos
MINI-55wq-7g35-3vqx
-
minimos
MINI-5639-r58q-9c76
-
minimos
MINI-5h7v-fmhp-j3vh
-
minimos
MINI-692r-2x96-vf6g
-
minimos
MINI-69g5-59jg-2pff
-
minimos
MINI-6jmr-vrqv-239c
-
minimos
MINI-6vwg-87pq-3jxj
-
minimos
MINI-7584-g9gx-p3r4
-
minimos
MINI-75vg-ggmp-r9r3
-
minimos
MINI-7vvf-56w5-5534
-
minimos
MINI-858w-p6jg-7c74
-
minimos
MINI-89c4-7mhq-f9mh
-
minimos
MINI-8cr8-6fxq-c2jw
-
minimos
MINI-8h62-6q2v-w283
-
minimos
MINI-8pq7-g5hq-3mjh
-
minimos
MINI-8qrr-qg94-v57g
-
minimos
MINI-955j-qxrc-x99c
-
minimos
MINI-9m53-gh3q-4x89
-
minimos
MINI-9r4h-532x-968w
-
minimos
MINI-9x5h-hfhc-f9gr
-
minimos
MINI-c9rx-h63v-62r9
-
minimos
MINI-cc4v-g7jq-89j6
-
minimos
MINI-cqcg-5886-355g
-
minimos
MINI-frh2-fwr7-r48x
-
minimos
MINI-fv36-6wjr-wqq2
-
minimos
MINI-fwch-q9c9-hjmj
-
minimos
MINI-fxq9-4jw4-773h
-
minimos
MINI-h33m-f8cf-63pg
-
minimos
MINI-h47h-49j8-m59h
-
minimos
MINI-hcpf-q6x8-65jf
-
minimos
MINI-hq23-q8cr-r29j
-
minimos
MINI-j3gp-qcrq-j2xr
-
minimos
MINI-jc35-wc63-872r
-
minimos
MINI-m7wm-wj2h-r4hm
-
minimos
MINI-m823-q4c3-7h34
-
minimos
MINI-m89v-9495-4x2q
-
minimos
MINI-mh6j-h8mx-cvfm
-
minimos
MINI-mmfv-5j7r-8gwm
-
minimos
MINI-mp55-q32v-hm6m
-
minimos
MINI-mpwj-4v6x-gm37
-
minimos
MINI-mwg4-92h6-6wwh
-
minimos
MINI-pcq3-h432-f2rf
-
minimos
MINI-pgx9-278g-qq57
-
minimos
MINI-pj4p-wxrc-wgv7
-
minimos
MINI-px7j-vcwf-63w5
-
minimos
MINI-q255-j792-g3xc
-
minimos
MINI-q383-8w86-428v
-
minimos
MINI-qj3c-jp3h-qrw3
-
minimos
MINI-qjpq-fqxp-x43w
-
minimos
MINI-qjr2-jcr5-hvx2
-
minimos
MINI-qpjh-f8qr-m8h9
-
minimos
MINI-r553-xvvh-4f44
-
minimos
MINI-r5c6-5jmh-29j7
-
minimos
MINI-rg9q-33fg-8mhq
-
minimos
MINI-rmw6-g84w-6fvm
-
minimos
MINI-v38j-f953-qf3p
-
minimos
MINI-vcgj-6w5r-h8fv
-
minimos
MINI-vh2c-qwvq-vfrr
-
minimos
MINI-vq96-rgrq-xhc7
-
minimos
MINI-vx4g-g4fw-5wfr
-
minimos
MINI-w662-r24q-93hx
-
minimos
MINI-w6jq-gq4g-9796
-
minimos
MINI-w6r3-jcxc-jjvj
-
minimos
MINI-w7gq-qwfv-g3fq
-
minimos
MINI-ww63-v9fr-mp89
-
minimos
MINI-wx63-gm7r-qrw6
-
minimos
MINI-x3pg-m4wj-qmq9
-
minimos
MINI-x94g-m55p-vxh9
-
minimos
MINI-xf9r-5grv-xchm
-
minimos
MINI-xhpc-rjf5-cr7f
-