{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-59889", "tracking": { "current_release_date": "2026-08-19T09:42:18.961999Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-59889", "initial_release_date": "2026-07-14T20:50:56.697641Z", "revision_history": [ { "date": "2026-07-14T20:50:56.697641Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (5).| References created (4).| CWES updated (1)." }, { "date": "2026-07-14T20:50:58.589827Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-07-14T21:57:54.103823Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-07-14T21:57:56.607008Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-07-15T07:35:31.974921Z", "number": "5", "summary": "NCSC Score updated." }, { "date": "2026-07-15T11:07:49.080620Z", "number": "6", "summary": "Source connected.| CVE status created. (valid)| Products connected (5).| Products created (3).| References created (4)." }, { "date": "2026-07-15T11:07:52.072726Z", "number": "7", "summary": "NCSC Score updated." }, { "date": "2026-07-17T09:45:24.137420Z", "number": "8", "summary": "Unknown change." }, { "date": "2026-07-17T10:03:55.637235Z", "number": "9", "summary": "Source connected.| CVE status created. (valid)| EPSS created." }, { "date": "2026-07-17T10:03:59.488165Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-07-17T10:31:45.353856Z", "number": "11", "summary": "Products connected (1).| References created (1)." }, { "date": "2026-07-17T10:31:47.547195Z", "number": "12", "summary": "NCSC Score updated." }, { "date": "2026-07-17T12:45:50.348912Z", "number": "13", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (2)." }, { "date": "2026-07-17T13:25:35.336279Z", "number": "14", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (2).| Products connected (21).| References created (6).| CWES updated (1)." }, { "date": "2026-07-17T13:25:37.479436Z", "number": "15", "summary": "NCSC Score updated." }, { "date": "2026-07-18T07:25:59.948361Z", "number": "16", "summary": "Products created (1)." }, { "date": "2026-07-21T22:41:24.130210Z", "number": "17", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)." }, { "date": "2026-07-21T22:41:25.469339Z", "number": "18", "summary": "NCSC Score updated." }, { "date": "2026-07-22T00:16:45.665568Z", "number": "19", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (32).| Product Identifiers created (27).| References created (5).| CWES updated (1)." }, { "date": "2026-07-28T09:29:11.610922Z", "number": "20", "summary": "Products connected (1).| References created (2)." }, { "date": "2026-07-28T09:29:14.105690Z", "number": "21", "summary": "NCSC Score updated." }, { "date": "2026-07-28T12:45:56.064276Z", "number": "22", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products connected (4).| References created (7)." }, { "date": "2026-07-28T19:26:49.632571Z", "number": "23", "summary": "Source connected.| CVE status created. (valid)| Description created for source.| Products connected (6).| References created (7)." }, { "date": "2026-08-13T12:14:30.052493Z", "number": "24", "summary": "Products connected (2).| References created (2)." }, { "date": "2026-08-13T12:14:32.092910Z", "number": "25", "summary": "NCSC Score updated." }, { "date": "2026-08-17T12:11:00.898366Z", "number": "26", "summary": "Source connected.| CVE status created. (valid)| Products connected (1).| References created (3)." }, { "date": "2026-08-17T12:11:04.065349Z", "number": "27", "summary": "NCSC Score updated." }, { "date": "2026-08-19T07:11:26.191125Z", "number": "28", "summary": "Source created.| CVE status created. (valid)| Products created (3).| Product Identifiers created (3).| References created (3)." }, { "date": "2026-08-19T07:11:29.213221Z", "number": "29", "summary": "NCSC Score updated." }, { "date": "2026-08-19T09:39:59.800554Z", "number": "30", "summary": "Source connected.| CVE status created. (valid)" } ], "status": "interim", "version": "30" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/19.3-19.32", "product": { "name": "vers:unknown/19.3-19.32", "product_id": "CSAFPID-9010920", "product_identification_helper": { "cpe": "cpe:/a:oracle:database_server:19.3-19.32" } } }, { "category": "product_version_range", "name": "vers:unknown/21.3-21.23", "product": { "name": "vers:unknown/21.3-21.23", "product_id": "CSAFPID-9010922", "product_identification_helper": { "cpe": "cpe:/a:oracle:database_server:21.3-21.23" } } }, { "category": "product_version_range", "name": "vers:unknown/23.4.0-23.26.3", "product": { "name": "vers:unknown/23.4.0-23.26.3", "product_id": "CSAFPID-9010921", "product_identification_helper": { "cpe": "cpe:/a:oracle:database_server:23.4.0-23.26.3" } } } ], "category": "product_name", "name": "Database Server" } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1914402", "product_identification_helper": { "cpe": "cpe:/a:ibm:tivoli_network_manager:-" } } } ], "category": "product_name", "name": "IBM Tivoli Network Manager" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<2.18.8", "product": { "name": "vers:unknown/<2.18.8", "product_id": "CSAFPID-8491757" } }, { "category": "product_version_range", "name": "vers:unknown/<2.18.9", "product": { "name": "vers:unknown/<2.18.9", "product_id": "CSAFPID-8491762" } }, { "category": "product_version_range", "name": "vers:unknown/<2.21.4", "product": { "name": "vers:unknown/<2.21.4", "product_id": "CSAFPID-8491760" } }, { "category": "product_version_range", "name": "vers:unknown/<2.21.5", "product": { "name": "vers:unknown/<2.21.5", "product_id": "CSAFPID-8491761" } }, { "category": "product_version_range", "name": "vers:unknown/<2.22.1", "product": { "name": "vers:unknown/<2.22.1", "product_id": "CSAFPID-8835430" } }, { "category": "product_version_range", "name": "vers:unknown/<3.1.4", "product": { "name": "vers:unknown/<3.1.4", "product_id": "CSAFPID-8491759" } }, { "category": "product_version_range", "name": "vers:unknown/<3.1.5", "product": { "name": "vers:unknown/<3.1.5", "product_id": "CSAFPID-8835431" } }, { "category": "product_version_range", "name": "vers:unknown/<3.2.1", "product": { "name": "vers:unknown/<3.2.1", "product_id": "CSAFPID-8835432" } } ], "category": "product_name", "name": "Jackson" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/2.18.0", "product": { "name": "vers:unknown/2.18.0", "product_id": "CSAFPID-8490045", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.1", "product": { "name": "vers:unknown/2.18.1", "product_id": "CSAFPID-8490047", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.2", "product": { "name": "vers:unknown/2.18.2", "product_id": "CSAFPID-8490048", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.3", "product": { "name": "vers:unknown/2.18.3", "product_id": "CSAFPID-8490049", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.3" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.4", "product": { "name": "vers:unknown/2.18.4", "product_id": "CSAFPID-8490050", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.4" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.5", "product": { "name": "vers:unknown/2.18.5", "product_id": "CSAFPID-8490051", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.5" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.6", "product": { "name": "vers:unknown/2.18.6", "product_id": "CSAFPID-8490052", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.6" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.7", "product": { "name": "vers:unknown/2.18.7", "product_id": "CSAFPID-8490053", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.7" } } }, { "category": "product_version_range", "name": "vers:unknown/2.18.8", "product": { "name": "vers:unknown/2.18.8", "product_id": "CSAFPID-8490063", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.18.8" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.0", "product": { "name": "vers:unknown/2.21.0", "product_id": "CSAFPID-8490019", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.0" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.1", "product": { "name": "vers:unknown/2.21.1", "product_id": "CSAFPID-8490020", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.1" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.2", "product": { "name": "vers:unknown/2.21.2", "product_id": "CSAFPID-8490021", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.2" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.3", "product": { "name": "vers:unknown/2.21.3", "product_id": "CSAFPID-8490022", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.3" } } }, { "category": "product_version_range", "name": "vers:unknown/2.21.4", "product": { "name": "vers:unknown/2.21.4", "product_id": "CSAFPID-8490064", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.21.4" } } }, { "category": "product_version_range", "name": "vers:unknown/2.22.0", "product": { "name": "vers:unknown/2.22.0", "product_id": "CSAFPID-8511803", "product_identification_helper": { "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.22.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.0", "product": { "name": "vers:unknown/3.0.0", "product_id": "CSAFPID-8490023", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.1", "product": { "name": "vers:unknown/3.0.1", "product_id": "CSAFPID-8490024", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.2", "product": { "name": "vers:unknown/3.0.2", "product_id": "CSAFPID-8490025", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.3", "product": { "name": "vers:unknown/3.0.3", "product_id": "CSAFPID-8490026", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.0.4", "product": { "name": "vers:unknown/3.0.4", "product_id": "CSAFPID-8490027", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.0.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0", "product": { "name": "vers:unknown/3.1.0", "product_id": "CSAFPID-8490028", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.0-rc1", "product": { "name": "vers:unknown/3.1.0-rc1", "product_id": "CSAFPID-8490029", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.0-rc1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.1", "product": { "name": "vers:unknown/3.1.1", "product_id": "CSAFPID-8490030", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.1" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.2", "product": { "name": "vers:unknown/3.1.2", "product_id": "CSAFPID-8490031", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.2" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.3", "product": { "name": "vers:unknown/3.1.3", "product_id": "CSAFPID-8490032", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.3" } } }, { "category": "product_version_range", "name": "vers:unknown/3.1.4", "product": { "name": "vers:unknown/3.1.4", "product_id": "CSAFPID-8822935", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.1.4" } } }, { "category": "product_version_range", "name": "vers:unknown/3.2.0", "product": { "name": "vers:unknown/3.2.0", "product_id": "CSAFPID-8822936", "product_identification_helper": { "purl": "pkg:maven/tools.jackson.core/jackson-databind@3.2.0" } } }, { "category": "product_version_range", "name": "vers:unknown/>=2.18.0|<2.18.9", "product": { "name": "vers:unknown/>=2.18.0|<2.18.9", "product_id": "CSAFPID-8810887" } }, { "category": "product_version_range", "name": "vers:unknown/>=2.21.0|<2.21.5", "product": { "name": "vers:unknown/>=2.21.0|<2.21.5", "product_id": "CSAFPID-8810888" } }, { "category": "product_version_range", "name": "vers:unknown/>=2.22.0|<2.22.1", "product": { "name": "vers:unknown/>=2.22.0|<2.22.1", "product_id": "CSAFPID-8810889" } }, { "category": "product_version_range", "name": "vers:unknown/>=3.0.0|<3.1.5", "product": { "name": "vers:unknown/>=3.0.0|<3.1.5", "product_id": "CSAFPID-8810890" } }, { "category": "product_version_range", "name": "vers:unknown/>=3.2.0|<3.2.1", "product": { "name": "vers:unknown/>=3.2.0|<3.2.1", "product_id": "CSAFPID-8810891" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.0", "product": { "name": "vers:unknown/jackson-databind-2.18.0", "product_id": "CSAFPID-5545792" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.1", "product": { "name": "vers:unknown/jackson-databind-2.18.1", "product_id": "CSAFPID-5545794" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.2", "product": { "name": "vers:unknown/jackson-databind-2.18.2", "product_id": "CSAFPID-5545795" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.3", "product": { "name": "vers:unknown/jackson-databind-2.18.3", "product_id": "CSAFPID-5545796" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.4", "product": { "name": "vers:unknown/jackson-databind-2.18.4", "product_id": "CSAFPID-5545797" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.5", "product": { "name": "vers:unknown/jackson-databind-2.18.5", "product_id": "CSAFPID-5545798" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.6", "product": { "name": "vers:unknown/jackson-databind-2.18.6", "product_id": "CSAFPID-5686679" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.7", "product": { "name": "vers:unknown/jackson-databind-2.18.7", "product_id": "CSAFPID-8587070" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.18.8", "product": { "name": "vers:unknown/jackson-databind-2.18.8", "product_id": "CSAFPID-8587067" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.0", "product": { "name": "vers:unknown/jackson-databind-2.21.0", "product_id": "CSAFPID-5545809" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.1", "product": { "name": "vers:unknown/jackson-databind-2.21.1", "product_id": "CSAFPID-5686680" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.2", "product": { "name": "vers:unknown/jackson-databind-2.21.2", "product_id": "CSAFPID-8587073" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.3", "product": { "name": "vers:unknown/jackson-databind-2.21.3", "product_id": "CSAFPID-8587069" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.21.4", "product": { "name": "vers:unknown/jackson-databind-2.21.4", "product_id": "CSAFPID-8587066" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-2.22.0", "product": { "name": "vers:unknown/jackson-databind-2.22.0", "product_id": "CSAFPID-8850378" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.0.0", "product": { "name": "vers:unknown/jackson-databind-3.0.0", "product_id": "CSAFPID-5545810" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.0.1", "product": { "name": "vers:unknown/jackson-databind-3.0.1", "product_id": "CSAFPID-5545821" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.0", "product": { "name": "vers:unknown/jackson-databind-3.1.0", "product_id": "CSAFPID-5686681" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.0-rc1", "product": { "name": "vers:unknown/jackson-databind-3.1.0-rc1", "product_id": "CSAFPID-5545825" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.1", "product": { "name": "vers:unknown/jackson-databind-3.1.1", "product_id": "CSAFPID-8587072" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.2", "product": { "name": "vers:unknown/jackson-databind-3.1.2", "product_id": "CSAFPID-8587071" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.3", "product": { "name": "vers:unknown/jackson-databind-3.1.3", "product_id": "CSAFPID-8587068" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.1.4", "product": { "name": "vers:unknown/jackson-databind-3.1.4", "product_id": "CSAFPID-8850379" } }, { "category": "product_version_range", "name": "vers:unknown/jackson-databind-3.2.0", "product": { "name": "vers:unknown/jackson-databind-3.2.0", "product_id": "CSAFPID-8856380" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "vendor", "name": "FasterXML" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<12.7.1", "product": { "name": "vers:unknown/<12.7.1", "product_id": "CSAFPID-9001151" } } ], "category": "product_name", "name": "PDFreactor" } ], "category": "vendor", "name": "RealObjects" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317175", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "product_name", "name": "Red Hat Enterprise Linux" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317176", "product_identification_helper": { "cpe": "cpe:/o:suse:opensuse:-" } } } ], "category": "product_name", "name": "SUSE openSUSE" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/unknown", "product": { "name": "vers:unknown/unknown", "product_id": "CSAFPID-1317174", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "product_name", "name": "SuSE Linux" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product_id": "CSAFPID-8902929" } } ], "category": "product_name", "name": "jackson-annotations" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.25.1", "product_id": "CSAFPID-8902930" } } ], "category": "product_name", "name": "jackson-core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.33.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.33.1", "product_id": "CSAFPID-8902931" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Module for Basesystem 15 SP7" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903971" } } ], "category": "product_name", "name": "jackson-annotations" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903972" } } ], "category": "product_name", "name": "jackson-core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903973" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Server 16.0" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903974" } } ], "category": "product_name", "name": "jackson-annotations" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903975" } } ], "category": "product_name", "name": "jackson-core" }, { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product": { "name": "vers:unknown/>=0|<2.18.9-160000.1.1", "product_id": "CSAFPID-8903976" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Server for SAP applications 16.0" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=0|<2.18.9-150200.3.24.1", "product": { "name": "vers:unknown/>=0|<2.18.9-150200.3.24.1", "product_id": "CSAFPID-8902932" } } ], "category": "product_name", "name": "jackson-dataformats-binary" } ], "category": "product_family", "name": "SUSE:Linux Enterprise Module for Development Tools 15 SP7" } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-8616566" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "bookworm" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-8616567" } } ], "category": "product_name", "name": "jackson-databind" } ], "category": "product_family", "name": "bullseye" } ], "category": "vendor", "name": "Debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-59889", "cwe": { "id": "CWE-863", "name": "Incorrect Authorization" }, "notes": [ { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.", "title": "cveprojectv5 - https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59889.json" }, { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.", "title": "nvd - https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-59889" }, { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-59889" }, { "category": "description", "text": "jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped() replays buffered JSON for a @JsonUnwrapped property and calls prop.deserializeAndSet() without a prop.visibleInView(ctxt.getActiveView()) guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view. This issue is fixed in versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-59889.json?alt=media" }, { "category": "description", "text": "## Summary\n`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** — the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.\n\n**Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner `@JsonView` (the unwrapped sub-object's own `BeanDeserializer` gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**.\n\n## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)\nAn `@JsonView(AdminView)` property that is NOT `@JsonUnwrapped` → `null` under `PublicView` (correctly gated). The identical property WITH `@JsonUnwrapped` → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.\n\n## Impact — write-side mass-assignment / privilege escalation\n`@JsonView` is commonly used as a write-side authorization guard: a public endpoint binds the body under `readerWithView(PublicView.class)` and groups privileged state in a nested object whose container property is `@JsonView(AdminView)`. When that property is `@JsonUnwrapped`, an untrusted caller mass-assigns it. PoC: a self-service registration where `AccountFlags{role,approved,creditBalance}` is `@JsonView(AdminView) @JsonUnwrapped`; attacker JSON `{role:ADMIN,approved:true,creditBalance:1000000}` under `PublicView` binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (`C:N/I:H/A:N`); no worse than the C:L/I:L parent and arguably higher as `@JsonView`-as-write-guard is the exact use case #5971/#5969 defended.\n\n## Affected\n- `com.fasterxml.jackson.core:jackson-databind` 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). `DEFAULT_VIEW_INCLUSION` default=true.\n- `tools.jackson.core:jackson-databind` 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). `DEFAULT_VIEW_INCLUSION` default=false → the stock-config repro is the common shape where privileged inner fields are individually `@JsonView(PublicView)` and the developer relies on the container `@JsonView(AdminView)`; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)\n\n## Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)\n- nested `@JsonUnwrapped` (unwrapped-in-unwrapped) — recursive bypass.\n- merge / `readerWithView(...).withValueToUpdate(...)` (PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.\n- builder-based deserializer (`@JsonDeserialize(builder=...)`) — `BuilderBasedDeserializer` routes through the same `processUnwrapped`.\n- Honest non-findings: read-side serialization correctly honors views (no leak); `@JsonAnySetter`+view and `@JsonTypeInfo`+`@JsonUnwrapped` are separate/unsupported behaviors, not this bug.\n\n## Fix\nAdd `prop.visibleInView(ctxt.getActiveView())` (when `MapperFeature.DEFAULT_VIEW_INCLUSION`/active-view applies) to the `processUnwrapped()` property loop, mirroring `processUnwrappedCreatorProperties()`. One change closes the impact PoC + all three variants across `BeanDeserializer` and `BuilderBasedDeserializer`. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Maven%2FGHSA-5gvw-p9qm-jgwh.json?alt=media" }, { "category": "description", "text": "## Summary\n`UnwrappedPropertyHandler.processUnwrapped()` replays the buffered JSON for a `@JsonUnwrapped` property by iterating its properties and calling `prop.deserializeAndSet()` with **no `prop.visibleInView(ctxt.getActiveView())` guard** — the exact guard `processUnwrappedCreatorProperties()` received in the #5971 / GHSA-rcqc-6cw3-h962 fix, and the guard `BeanDeserializer.deserializeWithUnwrapped` applies to directly-matched properties. As a result, a property annotated with both `@JsonView(PrivilegedView.class)` and `@JsonUnwrapped` is written from attacker JSON even when deserializing under a more-restrictive active view.\n\n**Correction to the original framing (runtime-verified):** the gap is NOT a per-field inner `@JsonView` (the unwrapped sub-object's own `BeanDeserializer` gates inner fields correctly). The unchecked gate is the **view of the unwrapped CONTAINER property**.\n\n## Intent proof (runtime, 2.x HEAD 21dd70dd and 3.x HEAD 7a5939d6)\nAn `@JsonView(AdminView)` property that is NOT `@JsonUnwrapped` → `null` under `PublicView` (correctly gated). The identical property WITH `@JsonUnwrapped` → fully populated (bypass). The fix the creator path already received, not applied to the regular-property method.\n\n## Impact — write-side mass-assignment / privilege escalation\n`@JsonView` is commonly used as a write-side authorization guard: a public endpoint binds the body under `readerWithView(PublicView.class)` and groups privileged state in a nested object whose container property is `@JsonView(AdminView)`. When that property is `@JsonUnwrapped`, an untrusted caller mass-assigns it. PoC: a self-service registration where `AccountFlags{role,approved,creditBalance}` is `@JsonView(AdminView) @JsonUnwrapped`; attacker JSON `{role:ADMIN,approved:true,creditBalance:1000000}` under `PublicView` binds all three → approved admin with arbitrary balance. The failing gate is a WRITE gate, hence integrity-high (`C:N/I:H/A:N`); no worse than the C:L/I:L parent and arguably higher as `@JsonView`-as-write-guard is the exact use case #5971/#5969 defended.\n\n## Affected\n- `com.fasterxml.jackson.core:jackson-databind` 2.x: confirmed bypass at 21dd70dd (== released 2.21.4 / 2.22.0 line; includes the #5973 backport). `DEFAULT_VIEW_INCLUSION` default=true.\n- `tools.jackson.core:jackson-databind` 3.x: confirmed bypass at HEAD 7a5939d6 (latest 3.x). `DEFAULT_VIEW_INCLUSION` default=false → the stock-config repro is the common shape where privileged inner fields are individually `@JsonView(PublicView)` and the developer relies on the container `@JsonView(AdminView)`; the 3.x PoC mass-assigns role/approved/creditBalance under PublicView. (The other simultaneous report's PoC was reportedly fixed on 3.x; this distinct container-property path is not.)\n\n## Additive variants (runtime-confirmed both branches; all closed by the same one-line guard)\n- nested `@JsonUnwrapped` (unwrapped-in-unwrapped) — recursive bypass.\n- merge / `readerWithView(...).withValueToUpdate(...)` (PATCH/partial-update) — bypass; non-unwrapped merge control gates correctly.\n- builder-based deserializer (`@JsonDeserialize(builder=...)`) — `BuilderBasedDeserializer` routes through the same `processUnwrapped`.\n- Honest non-findings: read-side serialization correctly honors views (no leak); `@JsonAnySetter`+view and `@JsonTypeInfo`+`@JsonUnwrapped` are separate/unsupported behaviors, not this bug.\n\n## Fix\nAdd `prop.visibleInView(ctxt.getActiveView())` (when `MapperFeature.DEFAULT_VIEW_INCLUSION`/active-view applies) to the `processUnwrapped()` property loop, mirroring `processUnwrappedCreatorProperties()`. One change closes the impact PoC + all three variants across `BeanDeserializer` and `BuilderBasedDeserializer`. Full runnable PoCs (2.x + 3.x) + variant harnesses available on request.", "title": "github - https://api.github.com/advisories/GHSA-5gvw-p9qm-jgwh" }, { "category": "description", "text": "This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:\n\n- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of\n @JsonIgnoreProperties exclusions (bsc#1268902).\n- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to\n @JsonView restricted fields (bsc#1271440).\n- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of\n @JsonIgnore restrictions (bsc#1271442).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.9.\n\nChanges for jackson-bom:\n\n- Update to 2.18.9.\n\nChanges for jackson-core:\n\n- Update to 2.18.9.\n\nChanges for jackson-databind:\n\n- Update to 2.18.9:\n\n * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).\n\nChanges for jackson-dataformats-binary:\n\n- Update to 2.18.9.\n\nChanges for jackson-modules-base:\n\n- Update to 2.18.9.\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:3273-1.json?alt=media" }, { "category": "description", "text": "This update for jackson-annotations, jackson-core, jackson-databind fixes the following issues:\n\n- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of\n @JsonIgnoreProperties exclusions (bsc#1268902).\n- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to\n @JsonView restricted fields (bsc#1271440).\n- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of\n @JsonIgnore restrictions (bsc#1271442).\n\nChanges for jackson-annotations:\n\n- Update to 2.18.9.\n\nChanges for jackson-core:\n\n- Update to 2.18.9.\n\nChanges for jackson-databind:\n\n- Update to 2.18.9:\n\n * honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).\n", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:22822-1.json?alt=media" }, { "category": "other", "text": "0.00416", "title": "EPSS" }, { "category": "other", "text": "3.9", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "Is related to CWE-502 (Deserialization of Untrusted Data), Is related to an uncommon product vendor", "title": "NCSC Score top decreasing factors" } ], "product_status": { "known_affected": [ "CSAFPID-8810887", "CSAFPID-8810888", "CSAFPID-8810889", "CSAFPID-8810890", "CSAFPID-8810891", "CSAFPID-8491757", "CSAFPID-8491759", "CSAFPID-8491760", "CSAFPID-8491761", "CSAFPID-8491762", "CSAFPID-8835430", "CSAFPID-8835431", "CSAFPID-8835432", "CSAFPID-1317176", "CSAFPID-5545792", "CSAFPID-5545794", "CSAFPID-5545795", "CSAFPID-5545796", "CSAFPID-5545797", "CSAFPID-5545798", "CSAFPID-5545809", "CSAFPID-5545810", "CSAFPID-5545821", "CSAFPID-5545825", "CSAFPID-5686679", "CSAFPID-5686680", "CSAFPID-5686681", "CSAFPID-8587066", "CSAFPID-8587067", "CSAFPID-8587068", "CSAFPID-8587069", "CSAFPID-8587070", "CSAFPID-8587071", "CSAFPID-8587072", "CSAFPID-8587073", "CSAFPID-8850378", "CSAFPID-8850379", "CSAFPID-8856380", "CSAFPID-8490019", "CSAFPID-8490020", "CSAFPID-8490021", "CSAFPID-8490022", "CSAFPID-8490023", "CSAFPID-8490024", "CSAFPID-8490025", "CSAFPID-8490026", "CSAFPID-8490027", "CSAFPID-8490028", "CSAFPID-8490029", "CSAFPID-8490030", "CSAFPID-8490031", "CSAFPID-8490032", "CSAFPID-8490045", "CSAFPID-8490047", "CSAFPID-8490048", "CSAFPID-8490049", "CSAFPID-8490050", "CSAFPID-8490051", "CSAFPID-8490052", "CSAFPID-8490053", "CSAFPID-8490063", "CSAFPID-8490064", "CSAFPID-8511803", "CSAFPID-8822935", "CSAFPID-8822936", "CSAFPID-1317174", "CSAFPID-8902929", "CSAFPID-8902930", "CSAFPID-8902931", "CSAFPID-8902932", "CSAFPID-8903971", "CSAFPID-8903972", "CSAFPID-8903973", "CSAFPID-8903974", "CSAFPID-8903975", "CSAFPID-8903976", "CSAFPID-1317175", "CSAFPID-1914402", "CSAFPID-9001151", "CSAFPID-9010920", "CSAFPID-9010921", "CSAFPID-9010922" ], "known_not_affected": [ "CSAFPID-8616566", "CSAFPID-8616567" ] }, "references": [ { "category": "external", "summary": "Source - cveprojectv5", "url": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/59xxx/CVE-2026-59889.json" }, { "category": "external", "summary": "Source - nvd", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-59889" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2350.json" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss?limit=10000&offset=0" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-59889.json?alt=media" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-59889" }, { "category": "external", "summary": "Source - github", "url": "https://api.github.com/advisories/GHSA-5gvw-p9qm-jgwh" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/Maven%2FGHSA-5gvw-p9qm-jgwh.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:3273-1.json?alt=media" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/SUSE%2FSUSE-SU-2026:22822-1.json?alt=media" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2867.json" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2889.json" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0307" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; github; nvd; osv", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5gvw-p9qm-jgwh" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/FasterXML/jackson-databind/issues/6060" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/FasterXML/jackson-databind/pull/6056" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv", "url": "https://github.com/FasterXML/jackson-databind/commit/d627a8a86fcb062429282f79f3f256f181ed2c7b" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2350.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2350" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3pjw-73gf-8qr5" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RO25JYPE2IWVEMG5UKDXKT3LJB6ZRGKJ/" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59889.json" }, { "category": "external", "summary": "Reference - github; osv", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59889" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-5gvw-p9qm-jgwh" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027929.html" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-July/027920.html" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/support/update/announcement/2026/suse-su-20263273-1/" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1268902" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1271440" }, { "category": "external", "summary": "Reference - osv", "url": "https://bugzilla.suse.com/1271442" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-54515" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-59888" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/security/cve/CVE-2026-59889" }, { "category": "external", "summary": "Reference - osv", "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622822-1/" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.ibm.com/support/pages/node/7283607" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://access.redhat.com/errata/RHSA-2026:54440" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2867.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2867" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.pdfreactor.com/product/changelog.htm" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2889.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2889" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://www.oracle.com/security-alerts/cspuaug2026.html#AppendixDB" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-1317174", "CSAFPID-1317175", "CSAFPID-1317176", "CSAFPID-1914402", "CSAFPID-5545792", "CSAFPID-5545794", "CSAFPID-5545795", "CSAFPID-5545796", "CSAFPID-5545797", "CSAFPID-5545798", "CSAFPID-5545809", "CSAFPID-5545810", "CSAFPID-5545821", "CSAFPID-5545825", "CSAFPID-5686679", "CSAFPID-5686680", "CSAFPID-5686681", "CSAFPID-8490019", "CSAFPID-8490020", "CSAFPID-8490021", "CSAFPID-8490022", "CSAFPID-8490023", "CSAFPID-8490024", "CSAFPID-8490025", "CSAFPID-8490026", "CSAFPID-8490027", "CSAFPID-8490028", "CSAFPID-8490029", "CSAFPID-8490030", "CSAFPID-8490031", "CSAFPID-8490032", "CSAFPID-8490045", "CSAFPID-8490047", "CSAFPID-8490048", "CSAFPID-8490049", "CSAFPID-8490050", "CSAFPID-8490051", "CSAFPID-8490052", "CSAFPID-8490053", "CSAFPID-8490063", "CSAFPID-8490064", "CSAFPID-8491757", "CSAFPID-8491759", "CSAFPID-8491760", "CSAFPID-8491761", "CSAFPID-8491762", "CSAFPID-8511803", "CSAFPID-8587066", "CSAFPID-8587067", "CSAFPID-8587068", "CSAFPID-8587069", "CSAFPID-8587070", "CSAFPID-8587071", "CSAFPID-8587072", "CSAFPID-8587073", "CSAFPID-8810887", "CSAFPID-8810888", "CSAFPID-8810889", "CSAFPID-8810890", "CSAFPID-8810891", "CSAFPID-8822935", "CSAFPID-8822936", "CSAFPID-8835430", "CSAFPID-8835431", "CSAFPID-8835432", "CSAFPID-8850378", "CSAFPID-8850379", "CSAFPID-8856380", "CSAFPID-8902929", "CSAFPID-8902930", "CSAFPID-8902931", "CSAFPID-8902932", "CSAFPID-8903971", "CSAFPID-8903972", "CSAFPID-8903973", "CSAFPID-8903974", "CSAFPID-8903975", "CSAFPID-8903976", "CSAFPID-9001151", "CSAFPID-9010920", "CSAFPID-9010921", "CSAFPID-9010922" ] } ], "title": "CVE-2026-59889" } ] }