How severe is GHSA-3pjw-73gf-8qr5?

GHSA-3pjw-73gf-8qr5 has a CVSS score of 6.5/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-3pjw-73gf-8qr5?

GHSA-3pjw-73gf-8qr5 affects the following packages: com.fasterxml.jackson.core:jackson-databind (Maven), com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Ecosystems affected: Maven.

How do I fix GHSA-3pjw-73gf-8qr5?

Update com.fasterxml.jackson.core:jackson-databind to 2.18.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3pjw-73gf-8qr5 is resolved across your whole dependency graph.

How do I detect GHSA-3pjw-73gf-8qr5 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.fasterxml.jackson.core:jackson-databind. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

How do I mitigate GHSA-3pjw-73gf-8qr5 if there is no patch (or I can't update yet)?

If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

How does O3 Security protect against GHSA-3pjw-73gf-8qr5?

O3 pinpoints whether GHSA-3pjw-73gf-8qr5 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Is GHSA-3pjw-73gf-8qr5 actively exploited in the wild?

No public exploit code has been indexed for GHSA-3pjw-73gf-8qr5 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What type of vulnerability is GHSA-3pjw-73gf-8qr5?

GHSA-3pjw-73gf-8qr5 is classified as CWE-915 (CWE-915). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was GHSA-3pjw-73gf-8qr5 published, and has it been updated?

GHSA-3pjw-73gf-8qr5 was published on July 21, 2026 and was last updated on July 25, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕ Maven

GHSA-3pjw-73gf-8qr5

MEDIUM

jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy

Also known asCVE-2026-59888

Published

Jul 21, 2026

Updated

Jul 25, 2026

Affected

3 pkgs

Patched

3 / 3

Exploits

None indexed

Blast Radius

3 pkgs affected

☕com.fasterxml.jackson.core:jackson-databind☕com.fasterxml.jackson.core:jackson-databind☕tools.jackson.core:jackson-databind

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Summary

For Java Records, POJOPropertiesCollector._removeUnwantedIgnorals() records a @JsonIgnore-annotated component under its original implicit name before _renameUsing() applies the PropertyNamingStrategy. After the rename, _ignoredPropertyNames still holds only the pre-rename name, so _ignorableProps is built from the stale key. The renamed JSON key passes IgnorePropertiesUtil.shouldIgnore() and is assigned to the Record's constructor parameter, defeating the @JsonIgnore.

Impact

A Record using a naming strategy that relies on @JsonIgnore to keep an internal/privileged component out of deserialization can have that component set from the wire via its renamed key (e.g. a role/flag controlled by an untrusted client).

Affected / Patched (verified via `git tag --contains`)

2.15-2.18 line: >= 2.15.0, < 2.18.8 -> fixed in 2.18.8 (backport c7c6783)
2.19-2.21 line: >= 2.19.0, < 2.21.4 -> fixed in 2.21.4
3.x line: >= 3.0.0, < 3.1.4 -> fixed in 3.1.4 (#5974, baa2cdf)

Severity / CWE

Maintainer: minor. Reporter: Moderate. CWE-915; related CWE-345.

Credits

Omkhar Arasaratnam (@omkhar) - finder.

Affected Packages

3 total 3 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`com.fasterxml.jackson.core:jackson-databind`	≥ 2.15.0&&< 2.18.8	2.18.8
☕Maven	`com.fasterxml.jackson.core:jackson-databind`	≥ 2.19.0&&< 2.21.4	2.21.4
☕Maven	`tools.jackson.core:jackson-databind`	≥ 3.0.0&&< 3.1.4	3.1.4

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.fasterxml.jackson.core:jackson-databind. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update com.fasterxml.jackson.core:jackson-databind to 2.18.8 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-3pjw-73gf-8qr5 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether GHSA-3pjw-73gf-8qr5 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to GHSA-3pjw-73gf-8qr5. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

## Summary For Java Records, `POJOPropertiesCollector._removeUnwantedIgnorals()` records a `@JsonIgnore`-annotated component under its original implicit name before `_renameUsing()` applies the `PropertyNamingStrategy`. After the rename, `_ignoredPropertyNames` still holds only the pre-rename name, so `_ignorableProps` is built from the stale key. The renamed JSON key passes `IgnorePropertiesUtil.shouldIgnore()` and is assigned to the Record's constructor parameter, defeating the `@JsonIgnore`. ## Impact A Record using a naming strategy that relies on `@JsonIgnore` to keep an internal/privile

O3 Security · Impact-Aware SCA

Is GHSA-3pjw-73gf-8qr5 in your dependencies?

O3 detects GHSA-3pjw-73gf-8qr5 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works