{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-59888", "tracking": { "current_release_date": "2026-08-25T13:40:06.258231Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-59888", "initial_release_date": "2026-07-14T17:43:48.899862Z", "revision_history": [ { "date": "2026-07-14T17:43:48.899862Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-07-14T17:43:52.257562Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-07-14T17:47:45.096896Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| Products connected (2).| References created (4).| CWES updated (1)." }, { "date": "2026-07-14T17:47:55.468775Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-07-14T19:14:28.626471Z", "number": "5", "summary": "Unknown change." }, { "date": "2026-07-15T10:42:44.754674Z", "number": "6", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (27).| References created (6).| CWES updated (1)." }, { "date": "2026-07-15T11:07:48.635718Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Products connected (3).| References created (4)." }, { "date": "2026-07-15T11:07:51.026625Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-07-17T10:03:55.842684Z", "number": "9", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-07-17T10:03:59.488165Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-07-17T10:31:44.878794Z", "number": "11", "summary": "Products connected (1).| Product Identifiers created (1).| References created (1)." }, { "date": "2026-07-17T10:31:46.618033Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-07-17T12:45:50.975472Z", "number": "13", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (2)." }, { "date": "2026-07-17T12:45:55.646302Z", "number": "14", "summary": "NCSC Score updated." }, { "date": "2026-07-21T19:59:44.176023Z", "number": "15", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)." }, { "date": "2026-07-21T19:59:55.812892Z", "number": "16", "summary": "NCSC Score updated." }, { "date": "2026-07-22T00:16:43.626814Z", "number": "17", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (49).| Product Identifiers created (46).| References created (5).| CWES updated (1)." }, { "date": "2026-07-28T09:29:10.643338Z", "number": "18", "summary": "Products connected (1).| Product Identifiers created (1).| References created (2)." }, { "date": "2026-07-28T09:29:13.047800Z", "number": "19", "summary": "NCSC Score updated." }, { "date": "2026-07-28T12:45:56.521989Z", "number": "20", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products connected (4).| References created (7)." }, { "date": "2026-07-28T19:26:50.055653Z", "number": "21", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products connected (6).| References created (7)." }, { "date": "2026-08-13T12:14:29.555992Z", "number": "22", "summary": "Products connected (2).| Product Identifiers created (2).| References created (2)." }, { "date": "2026-08-13T12:14:31.148087Z", "number": "23", "summary": "NCSC Score updated." }, { "date": "2026-08-13T12:27:56.780499Z", "number": "24", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (2).| Product Remediations created (2).| Product Identifiers created (4).| Product Identifiers removed (4).| References created (14).| CWES updated (1)." }, { "date": "2026-08-13T12:27:59.178044Z", "number": "25", "summary": "NCSC Score updated." }, { "date": "2026-08-17T12:11:00.718612Z", "number": "26", "summary": "Source connected.| CVE status created. (valid)| Products connected (1).| References created (3)." }, { "date": "2026-08-17T12:11:04.065349Z", "number": "27", "summary": "NCSC Score updated." }, { "date": "2026-08-19T11:13:29.982639Z", "number": "28", "summary": "Source connected.| CVE status created. (valid)| Products connected (1).| References created (3)." }, { "date": "2026-08-19T11:13:31.482234Z", "number": "29", "summary": "NCSC Score updated." }, { "date": "2026-08-19T15:16:43.291889Z", "number": "30", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-08-19T15:17:34.060635Z", "number": "31", "summary": "NCSC Score updated." }, { "date": "2026-08-20T18:26:10.317076Z", "number": "32", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (1).| Product Threats created (1).| Product Remediations created (1).| References created (2)." }, { "date": "2026-08-20T18:26:13.536167Z", "number": "33", "summary": "NCSC Score updated." }, { "date": "2026-08-21T08:28:12.253021Z", "number": "34", "summary": "NCSC Score updated." }, { "date": "2026-08-25T06:05:48.929184Z", "number": "35", "summary": "Products connected (2).| References created (5)." }, { "date": "2026-08-25T06:05:51.477500Z", "number": "36", "summary": "NCSC Score updated." }, { "date": "2026-08-25T13:39:58.577267Z", "number": "37", "summary": "Source connected.| CVE status created. (valid)" }, { "date": "2026-08-25T13:40:01.511239Z", "number": "38", "summary": "NCSC Score updated." } ], "status": "interim", "version": "38" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/keycloak", "product": { "name": "vers:unknown/keycloak", "product_id": "CSAFPID-5187459", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:keycloak" } } } ], "category": "product_name", "name": "Enterprise Linux" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317175", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1.0", "product": { "name": "vers:rpm/1.0", "product_id": "CSAFPID-5273706", "product_identification_helper": { "cpe": "cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9" } } } ], "category": "product_name", "name": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0" }, { "branches": [ { "category": "product_version_range", "name": "vers:oci/1786378722", "product": { "name": "vers:oci/1786378722", "product_id": "CSAFPID-8979713", "product_identification_helper": { "purl": "pkg:oci/runtimes-agent-init-rhel9@sha256%3Aa6fc33e05610c80a5f2be7589394eaf9ea7e85568d001c601a214535df7e9a85?arch=amd64&repository_url=registry.redhat.io/rh-lightspeed-runtimes/runtimes-agent-init-rhel9&tag=1786378722" } } } ], "category": "product_name", "name": "runtimes-agent-init-rhel9" } ], "category": "product_family", "name": "Red Hat Lightspeed (formerly Insights) for Runtimes" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1914402", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:-" } } } ], "category": "product_name", "name": "IBM Tivoli Network Manager" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<2.18.8", "product": { "name": "vers:unknown/<2.18.8", "product_id": "CSAFPID-8491757" } }, { "category": "product_version_range", "name": "vers:unknown/<2.21.4", "product": { "name": "vers:unknown/<2.21.4", "product_id": "CSAFPID-8491760" } }, { "category": "product_version_range", "name": "vers:unknown/<3.1.4", "product": { "name": "vers:unknown/<3.1.4", "product_id": "CSAFPID-8491759" } } ], "category": "product_name", "name": "Jackson" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/2.15.0", "product": { "name": "vers:unknown/2.15.0", "product_id": "CSAFPID-2859110", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.15.1", "product": { "name": "vers:unknown/2.15.1", "product_id": "CSAFPID-2859118", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.15.2", "product": { "name": "vers:unknown/2.15.2", "product_id": "CSAFPID-2859116", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.15.3", "product": { "name": "vers:unknown/2.15.3", "product_id": "CSAFPID-8490034", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.3" } } }, { "category": "product_version_range", "name": "vers:unknown/2.15.4", "product": { "name": "vers:unknown/2.15.4", "product_id": "CSAFPID-8490035", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.15.4" } } }, { "category": "product_version_range", "name": "vers:unknown/2.16.0", "product": { "name": "vers:unknown/2.16.0", "product_id": "CSAFPID-8490036", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.16.0-rc1", "product": { "name": "vers:unknown/2.16.0-rc1", "product_id": "CSAFPID-8490037", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.0-rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.16.1", "product": { "name": "vers:unknown/2.16.1", "product_id": "CSAFPID-8490038", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.16.2", "product": { "name": "vers:unknown/2.16.2", "product_id": "CSAFPID-8490039", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.16.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.17.0", "product": { "name": "vers:unknown/2.17.0", "product_id": "CSAFPID-8490040", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.17.0-rc1", "product": { "name": "vers:unknown/2.17.0-rc1", "product_id": "CSAFPID-8490041", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.0-rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.17.1", "product": { "name": "vers:unknown/2.17.1", "product_id": "CSAFPID-8490042", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.17.2", "product": { "name": "vers:unknown/2.17.2", "product_id": "CSAFPID-8490043", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.17.3", "product": { "name": "vers:unknown/2.17.3", "product_id": "CSAFPID-8490044", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.17.3" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.0", "product": { "name": "vers:unknown/2.18.0", "product_id": "CSAFPID-8490045", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.0-rc1", "product": { "name": "vers:unknown/2.18.0-rc1", "product_id": "CSAFPID-8490046", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0-rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.1", "product": { "name": "vers:unknown/2.18.1", "product_id": "CSAFPID-8490047", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.2", "product": { "name": "vers:unknown/2.18.2", "product_id": "CSAFPID-8490048", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.3", "product": { "name": "vers:unknown/2.18.3", "product_id": "CSAFPID-8490049", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.4", "product": { "name": "vers:unknown/2.18.4", "product_id": "CSAFPID-8490050", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.5", "product": { "name": "vers:unknown/2.18.5", "product_id": "CSAFPID-8490051", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.6", "product": { "name": "vers:unknown/2.18.6", "product_id": "CSAFPID-8490052", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.6" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.7", "product": { "name": "vers:unknown/2.18.7", "product_id": "CSAFPID-8490053", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.7" } } }, { "category": "product_version_range", "name": "vers:unknown/2.19.0", "product": { "name": "vers:unknown/2.19.0", "product_id": "CSAFPID-8490054", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.19.1", "product": { "name": "vers:unknown/2.19.1", "product_id": "CSAFPID-8490055", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.19.2", "product": { "name": "vers:unknown/2.19.2", "product_id": "CSAFPID-8490056", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.19.3", "product": { "name": "vers:unknown/2.19.3", "product_id": "CSAFPID-8490057", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.3" } } }, { "category": "product_version_range", "name": "vers:unknown/2.19.4", "product": { "name": "vers:unknown/2.19.4", "product_id": "CSAFPID-8490058", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.19.4" } } }, { "category": "product_version_range", "name": "vers:unknown/2.20.0", "product": { "name": "vers:unknown/2.20.0", "product_id": "CSAFPID-8490059", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.20.0-rc1", "product": { "name": "vers:unknown/2.20.0-rc1", "product_id": "CSAFPID-8490060", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.0-rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.20.1", "product": { "name": "vers:unknown/2.20.1", "product_id": "CSAFPID-8490061", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.20.2", "product": { "name": "vers:unknown/2.20.2", "product_id": "CSAFPID-8490062", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.20.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.0", "product": { "name": "vers:unknown/2.21.0", "product_id": "CSAFPID-8490019", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.1", "product": { "name": "vers:unknown/2.21.1", "product_id": "CSAFPID-8490020", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.2", "product": { "name": "vers:unknown/2.21.2", "product_id": "CSAFPID-8490021", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.3", "product": { "name": "vers:unknown/2.21.3", "product_id": "CSAFPID-8490022", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0", "product": { "name": "vers:unknown/3.0.0", "product_id": "CSAFPID-8490023", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.1", "product": { "name": "vers:unknown/3.0.1", "product_id": "CSAFPID-8490024", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.2", "product": { "name": "vers:unknown/3.0.2", "product_id": "CSAFPID-8490025", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.3", "product": { "name": "vers:unknown/3.0.3", "product_id": "CSAFPID-8490026", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.4", "product": { "name": "vers:unknown/3.0.4", "product_id": "CSAFPID-8490027", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0", "product": { "name": "vers:unknown/3.1.0", "product_id": "CSAFPID-8490028", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0-rc1", "product": { "name": "vers:unknown/3.1.0-rc1", "product_id": "CSAFPID-8490029", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0-rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.1", "product": { "name": "vers:unknown/3.1.1", "product_id": "CSAFPID-8490030", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.2", "product": { "name": "vers:unknown/3.1.2", "product_id": "CSAFPID-8490031", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.3", "product": { "name": "vers:unknown/3.1.3", "product_id": "CSAFPID-8490032", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/>=2.15.0|<2.18.8", "product": { "name": "vers:unknown/>=2.15.0|<2.18.8", "product_id": "CSAFPID-8808566" } }, { "category": "product_version_range", "name": "vers:unknown/>=2.19.0|<2.21.4", "product": { "name": "vers:unknown/>=2.19.0|<2.21.4", "product_id": "CSAFPID-8489922" } }, { "category": "product_version_range", "name": "vers:unknown/>=3.0.0|<3.1.4", "product": { "name": "vers:unknown/>=3.0.0|<3.1.4", "product_id": "CSAFPID-8489917" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.15.0", "product": { "name": "vers:unknown/jackson-databind-2.15.0", "product_id": "CSAFPID-4146520" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.16.0", "product": { "name": "vers:unknown/jackson-databind-2.16.0", "product_id": "CSAFPID-5545784" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.16.0-rc1", "product": { "name": "vers:unknown/jackson-databind-2.16.0-rc1", "product_id": "CSAFPID-4146527" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.17.0-rc1", "product": { "name": "vers:unknown/jackson-databind-2.17.0-rc1", "product_id": "CSAFPID-5545788" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.0", "product": { "name": "vers:unknown/jackson-databind-2.18.0", "product_id": "CSAFPID-5545792" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.0-rc1", "product": { "name": "vers:unknown/jackson-databind-2.18.0-rc1", "product_id": "CSAFPID-5545793" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.1", "product": { "name": "vers:unknown/jackson-databind-2.18.1", "product_id": "CSAFPID-5545794" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.2", "product": { "name": "vers:unknown/jackson-databind-2.18.2", "product_id": "CSAFPID-5545795" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.3", "product": { "name": "vers:unknown/jackson-databind-2.18.3", "product_id": "CSAFPID-5545796" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.4", "product": { "name": "vers:unknown/jackson-databind-2.18.4", "product_id": "CSAFPID-5545797" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.5", "product": { "name": "vers:unknown/jackson-databind-2.18.5", "product_id": "CSAFPID-5545798" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.6", "product": { "name": "vers:unknown/jackson-databind-2.18.6", "product_id": "CSAFPID-5686679" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.7", "product": { "name": "vers:unknown/jackson-databind-2.18.7", "product_id": "CSAFPID-8587070" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.19.0", "product": { "name": "vers:unknown/jackson-databind-2.19.0", "product_id": "CSAFPID-5545799" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.20.0", "product": { "name": "vers:unknown/jackson-databind-2.20.0", "product_id": "CSAFPID-5545805" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.20.0-rc1", "product": { "name": "vers:unknown/jackson-databind-2.20.0-rc1", "product_id": "CSAFPID-5545806" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.0", "product": { "name": "vers:unknown/jackson-databind-2.21.0", "product_id": "CSAFPID-5545809" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.1", "product": { "name": "vers:unknown/jackson-databind-2.21.1", "product_id": "CSAFPID-5686680" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.2", "product": { "name": "vers:unknown/jackson-databind-2.21.2", "product_id": "CSAFPID-8587073" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.3", "product": { "name": "vers:unknown/jackson-databind-2.21.3", "product_id": "CSAFPID-8587069" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.0.0", "product": { "name": "vers:unknown/jackson-databind-3.0.0", "product_id": "CSAFPID-5545810" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.0.1", "product": { "name": "vers:unknown/jackson-databind-3.0.1", "product_id": "CSAFPID-5545821" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.0", "product": { "name": "vers:unknown/jackson-databind-3.1.0", "product_id": "CSAFPID-5686681" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.0-rc1", "product": { "name": "vers:unknown/jackson-databind-3.1.0-rc1", "product_id": "CSAFPID-5545825" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.1", "product": { "name": "vers:unknown/jackson-databind-3.1.1", "product_id": "CSAFPID-8587072" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.2", "product": { "name": "vers:unknown/jackson-databind-3.1.2", "product_id": "CSAFPID-8587071" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.3", "product": { "name": "vers:unknown/jackson-databind-3.1.3", "product_id": "CSAFPID-8587068" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "vendor", "name": "FasterXML" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<26.7.2", "product": { "name": "vers:unknown/<26.7.2", "product_id": "CSAFPID-9012188" } } ], "category": "product_name", "name": "Keycloak" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:oracle/semver/23.4.0-23.26.3", "product": { "name": "vers:oracle/semver/23.4.0-23.26.3", "product_id": "CSAFPID-9028688", "product_identification_helper": { "cpe": "cpe:2.3:a:oracle:database_-_rdbms:23.4.0-23.26.3:*:*:*:*:*:*:*" } } } ], "category": "product_name", "name": "Oracle Database Server" } ], "category": "product_family", "name": "Oracle Database Server" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<12.7.1", "product": { "name": "vers:unknown/<12.7.1", "product_id": "CSAFPID-9001151" } } ], "category": "product_name", "name": "PDFreactor" } ], "category": "vendor", "name": "RealObjects" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317176", "product_identification_helper": { "cpe": "cpe:/o:suse:opensuse:-" } } } ], "category": "product_name", "name": "SUSE openSUSE" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317174", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "product_name", "name": "SuSE Linux" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product_id": "CSAFPID-8902929" } } ], "category": "product_name", "name": "jackson-annotations" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product_id": "CSAFPID-8902930" } } ], "category": "product_name", "name": "jackson-core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.33.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.33.1", "product_id": "CSAFPID-8902931" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Module for Basesystem 15 SP7" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903971" } } ], "category": "product_name", "name": "jackson-annotations" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903972" } } ], "category": "product_name", "name": "jackson-core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903973" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Server 16.0" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903974" } } ], "category": "product_name", "name": "jackson-annotations" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903975" } } ], "category": "product_name", "name": "jackson-core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903976" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Server for SAP applications 16.0" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.24.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.24.1", "product_id": "CSAFPID-8902932" } } ], "category": "product_name", "name": "jackson-dataformats-binary" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Module for Development Tools 15 SP7" } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-8616566" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "bookworm" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-8616567" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "bullseye" } ], "category": "vendor", "name": "Debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-59888", "cwe": { "id": "CWE-915", "name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes" }, "flags": [ { "label": "vulnerable_code_cannot_be_controlled_by_adversary", "product_ids": [ "CSAFPID-9028688" ] } ], "notes": [ { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59888.json" }, { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-59888" }, { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-59888.json?alt=media" }, { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-59888" }, { "category": "description", "text": "## Summary\nFor Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record's constructor parameter, defeating the `@JsonIgnore`.\n\n## Impact\nA Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.15-2.18 line: `>= 2.15.0, < 2.18.8` -> fixed in **2.18.8** (backport `c7c6783`)\n- 2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4**\n- 3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4** (#5974, `baa2cdf`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Maven%2FGHSA-3pjw-73gf-8qr5.json?alt=media" }, { "category": "description", "text": "## Summary\nFor Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record's constructor parameter, defeating the `@JsonIgnore`.\n\n## Impact\nA Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).\n\n## Affected / Patched (verified via `git tag --contains`)\n- 2.15-2.18 line: `>= 2.15.0, < 2.18.8` -> fixed in **2.18.8** (backport `c7c6783`)\n- 2.19-2.21 line: `>= 2.19.0, < 2.21.4` -> fixed in **2.21.4**\n- 3.x line: `>= 3.0.0, < 3.1.4` -> fixed in **3.1.4** (#5974, `baa2cdf`)\n\n## Severity / CWE\nMaintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.\n\n## Credits\nOmkhar Arasaratnam (@omkhar) - finder.", "title": "github - https://api.github.com/advisories/GHSA-3pjw-73gf-8qr5" }, { "category": "description", "text": "This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:\n\n- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of\n @JsonIgnoreProperties exclusions (bsc#1268902).\n- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to\n @JsonView restricted fields (bsc#1271440).\n- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of\n @JsonIgnore restrictions (bsc#1271442).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.9.\n\nChanges for jackson-bom:\n\n- Update to 2.18.9.\n\nChanges for jackson-core:\n\n- Update to 2.18.9.\n\nChanges for jackson-databind:\n\n- Update to 2.18.9:\n\n * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).\n\nChanges for jackson-dataformats-binary:\n\n- Update to 2.18.9.\n\nChanges for jackson-modules-base:\n\n- Update to 2.18.9.\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:3273-1.json?alt=media" }, { "category": "description", "text": "This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of\n @JsonIgnoreProperties exclusions (bsc#1268902).\n- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to\n @JsonView restricted fields (bsc#1271440).\n- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of\n @JsonIgnore restrictions (bsc#1271442).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.9.\n\nChanges for jackson-core:\n\n- Update to 2.18.9.\n\nChanges for jackson-databind:\n\n- Update to 2.18.9:\n\n * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:22822-1.json?alt=media" }, { "category": "description", "text": "A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an untrusted client could set internal or privileged components from external input, potentially leading to unauthorized modification or disclosure of sensitive data.", "title": "redhat - https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:54440.json" }, { "category": "description", "text": "Security-in-Depth issue in the RDBMS (jackson-databind) component of Oracle Database Server. This vulnerability cannot be exploited in the context of this product.", "title": "oracle - https://www.oracle.com/a/tech/docs/security-alerts/cspuaug2026csaf.json" }, { "category": "other", "text": "0.00247", "title": "EPSS" }, { "category": "other", "text": "4.4", "title": "NCSC Score" }, { "category": "other", "text": "There is product_remediation data available from source Oracle, VENDOR FIX as product remediation category, There is product data available from source Certbundde, Is related to (a version of) an uncommon product", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to a product by vendor Open Source, Is related to a product by vendor Ibm", "title": "NCSC Score top decreasing factors" } ], "product_status": { "fixed": [ "CSAFPID-8979713" ], "known_affected": [ "CSAFPID-8489917", "CSAFPID-8489922", "CSAFPID-8808566", "CSAFPID-4146520", "CSAFPID-4146527", "CSAFPID-5545784", "CSAFPID-5545788", "CSAFPID-5545792", "CSAFPID-5545793", "CSAFPID-5545794", "CSAFPID-5545795", "CSAFPID-5545796", "CSAFPID-5545797", "CSAFPID-5545798", "CSAFPID-5545799", "CSAFPID-5545805", "CSAFPID-5545806", "CSAFPID-5545809", "CSAFPID-5545810", "CSAFPID-5545821", "CSAFPID-5545825", "CSAFPID-5686679", "CSAFPID-5686680", "CSAFPID-5686681", "CSAFPID-8587068", "CSAFPID-8587069", "CSAFPID-8587070", "CSAFPID-8587071", "CSAFPID-8587072", "CSAFPID-8587073", "CSAFPID-8491757", "CSAFPID-8491759", "CSAFPID-8491760", "CSAFPID-1317176", "CSAFPID-2859110", "CSAFPID-2859116", "CSAFPID-2859118", "CSAFPID-8490019", "CSAFPID-8490020", "CSAFPID-8490021", "CSAFPID-8490022", "CSAFPID-8490023", "CSAFPID-8490024", "CSAFPID-8490025", "CSAFPID-8490026", "CSAFPID-8490027", "CSAFPID-8490028", "CSAFPID-8490029", "CSAFPID-8490030", "CSAFPID-8490031", "CSAFPID-8490032", "CSAFPID-8490034", "CSAFPID-8490035", "CSAFPID-8490036", "CSAFPID-8490037", "CSAFPID-8490038", "CSAFPID-8490039", "CSAFPID-8490040", "CSAFPID-8490041", "CSAFPID-8490042", "CSAFPID-8490043", "CSAFPID-8490044", "CSAFPID-8490045", "CSAFPID-8490046", "CSAFPID-8490047", "CSAFPID-8490048", "CSAFPID-8490049", "CSAFPID-8490050", "CSAFPID-8490051", "CSAFPID-8490052", "CSAFPID-8490053", "CSAFPID-8490054", "CSAFPID-8490055", "CSAFPID-8490056", "CSAFPID-8490057", "CSAFPID-8490058", "CSAFPID-8490059", "CSAFPID-8490060", "CSAFPID-8490061", "CSAFPID-8490062", "CSAFPID-1317174", "CSAFPID-8902929", "CSAFPID-8902930", "CSAFPID-8902931", "CSAFPID-8902932", "CSAFPID-8903971", "CSAFPID-8903972", "CSAFPID-8903973", "CSAFPID-8903974", "CSAFPID-8903975", "CSAFPID-8903976", "CSAFPID-1317175", "CSAFPID-1914402", "CSAFPID-9001151", "CSAFPID-9012188", "CSAFPID-5187459" ], "known_not_affected": [ "CSAFPID-8616566", "CSAFPID-8616567", "CSAFPID-9028688" ] }, "references": [ { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0326" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59888.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-59888" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-59888.json?alt=media" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2350.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-59888" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-3pjw-73gf-8qr5" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Maven%2FGHSA-3pjw-73gf-8qr5.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:3273-1.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:22822-1.json?alt=media" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/hydra/rest/securitydata/csaf/RHSA-2026:54440.json" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2867.json" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2915.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=10000" }, { "category": "external", "summary": "Source - oracle", "url": "https://www.oracle.com/a/tech/docs/security-alerts/cspuaug2026csaf.json" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-59888" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/FasterXML/jackson-databind/pull/5974" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/FasterXML/jackson-databind/commit/baa2cdf5ca2b2717fbb88d91955d69d8651df3e4" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/FasterXML/jackson-databind/commit/c7c678360624da5bc7eed2152789fa522880db9d" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59888.json" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59888" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2350.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2350" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RO25JYPE2IWVEMG5UKDXKT3LJB6ZRGKJ/" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-3pjw-73gf-8qr5" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027929.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027920.html" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263273-1/" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1268902" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1271440" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1271442" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-54515" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-59888" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-59889" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622822-1/" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7283607" }, { "category": "external", "summary": "Reference - certbundde; redhat", "url": "https://access.redhat.com/errata/RHSA-2026:54440" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-59888" }, { "category": "external", "summary": "Reference - redhat", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500096" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-59888" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-50193" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-54512" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-68494" }, { "category": "external", "summary": "Reference - redhat", "url": "https://access.redhat.com/security/updates/classification/" }, { "category": "external", "summary": "Reference - redhat", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54440.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2867.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2867" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.pdfreactor.com/product/changelog.htm" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2915.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2915" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.keycloak.org/2026/08/keycloak-2672-released" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/security-alerts/cspuaug2026.html" }, { "category": "external", "summary": "Reference - oracle", "url": "https://www.oracle.com/docs/tech/security-alerts/cspuaug2026csaf.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:56524" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:56523" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:56520" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:56519" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/Red-Darkin/CVE-2026-18963-keycloak" } ], "remediations": [ { "category": "vendor_fix", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "CSAFPID-5273706", "CSAFPID-8979713" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2026:54440" }, { "category": "vendor_fix", "details": "Oracle customers with valid support contracts", "product_ids": [ "CSAFPID-9028688" ], "url": "https://support.oracle.com/support/?documentId=CPU302" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1317174", "CSAFPID-1317175", "CSAFPID-1317176", "CSAFPID-1914402", "CSAFPID-2859110", "CSAFPID-2859116", "CSAFPID-2859118", "CSAFPID-4146520", "CSAFPID-4146527", "CSAFPID-5187459", "CSAFPID-5545784", "CSAFPID-5545788", "CSAFPID-5545792", "CSAFPID-5545793", "CSAFPID-5545794", "CSAFPID-5545795", "CSAFPID-5545796", "CSAFPID-5545797", "CSAFPID-5545798", "CSAFPID-5545799", "CSAFPID-5545805", "CSAFPID-5545806", "CSAFPID-5545809", "CSAFPID-5545810", "CSAFPID-5545821", "CSAFPID-5545825", "CSAFPID-5686679", "CSAFPID-5686680", "CSAFPID-5686681", "CSAFPID-8489917", "CSAFPID-8489922", "CSAFPID-8490019", "CSAFPID-8490020", "CSAFPID-8490021", "CSAFPID-8490022", "CSAFPID-8490023", "CSAFPID-8490024", "CSAFPID-8490025", "CSAFPID-8490026", "CSAFPID-8490027", "CSAFPID-8490028", "CSAFPID-8490029", "CSAFPID-8490030", "CSAFPID-8490031", "CSAFPID-8490032", "CSAFPID-8490034", "CSAFPID-8490035", "CSAFPID-8490036", "CSAFPID-8490037", "CSAFPID-8490038", "CSAFPID-8490039", "CSAFPID-8490040", "CSAFPID-8490041", "CSAFPID-8490042", "CSAFPID-8490043", "CSAFPID-8490044", "CSAFPID-8490045", "CSAFPID-8490046", "CSAFPID-8490047", "CSAFPID-8490048", "CSAFPID-8490049", "CSAFPID-8490050", "CSAFPID-8490051", "CSAFPID-8490052", "CSAFPID-8490053", "CSAFPID-8490054", "CSAFPID-8490055", "CSAFPID-8490056", "CSAFPID-8490057", "CSAFPID-8490058", "CSAFPID-8490059", "CSAFPID-8490060", "CSAFPID-8490061", "CSAFPID-8490062", "CSAFPID-8491757", "CSAFPID-8491759", "CSAFPID-8491760", "CSAFPID-8587068", "CSAFPID-8587069", "CSAFPID-8587070", "CSAFPID-8587071", "CSAFPID-8587072", "CSAFPID-8587073", "CSAFPID-8808566", "CSAFPID-8902929", "CSAFPID-8902930", "CSAFPID-8902931", "CSAFPID-8902932", "CSAFPID-8903971", "CSAFPID-8903972", "CSAFPID-8903973", "CSAFPID-8903974", "CSAFPID-8903975", "CSAFPID-8903976", "CSAFPID-9001151", "CSAFPID-9012188" ] } ], "threats": [ { "category": "impact", "details": "The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.", "product_ids": [ "CSAFPID-9028688" ] } ], "title": "CVE-2026-59888" } ] }