ROOT-APP-MAVEN-CVE-2026-59889 CVE-2026-59889 in com.fasterxml.jackson.core:jackson-databind - Patched by Root

Root has patched CVE-2026-59889 in the com.fasterxml.jackson.core:jackson-databind package for Root:Maven. Multiple fixed versions available...

CLEANSTART-2026-HU47571 Security fixes in gradle 9.7.1-r0

Package gradle version 9.7.1-r0 fixes 3 vulnerabilities: CVE-2026-59889, CVE-2026-54515, CVE-2026-71497...

Security Bulletin:Vulnerability in jackson-databind affects IBM Netezza Appliance

Summary The jackson-databind package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-54515, CVE-2026-59889 Vulnerability Details CVEID:CVE-2026-54515 DESCRIPTION: jackson-databind contains the general-purpose data-binding functionality and...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.

Summary IBM Maximo Application Suite - IoT Component uses jetty-http-10.0.26.jar, jackson-databind-2.22.0.jar, postgresql-42.7.11.jar, kafka-clients-3.9.1.jar which is vulnerable to CVE-2025-11143, CVE-2026-59889, CVE-2026-54291,CVE-2026-33558. This bulletin contains information regarding the...

CLEANSTART-2026-NP03031 Security fixes in apache-zookeeper 3.9.5-r5

Package apache-zookeeper version 3.9.5-r5 fixes 4 vulnerabilities: ghsa-r7wm-3cxj-wff9, CVE-2026-54515, CVE-2026-59889, ghsa-mhm7-754m-9p8w...

Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues: CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions...

SUSE-SU-2026:3273-1 Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base

This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues: - CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of @JsonIgnoreProperties exclusions...

Security Bulletin: Multiple vulnerabilities found in IBM ApplinX.

Summary IBM ApplinX has been updated in order to address multiple vulnerabilities CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-59888, CVE-2026-59889, CVE-2026-55223. Vulnerability Details CVEID:CVE-2026-54512 DESCRIPTION: jackson-databind contains the general-purpose...

CVE-2026-59889 vulnerabilities

Vulnerabilities for packages: opensearch, thingsboard, logstash, apache-nifi-registry, sonarqube, cassandra, ruby3.3-jrjackson, tez, infinispan, strimzi-kafka-operator, confluent-kafka, trino, zookeeper, flyway, jenkins-plugin-manager, gradle, ruby3.2-jrjackson, wavefront-proxy, akhq, scala,...

ai.covia:covia-discord (>=0.9.8, <=0.9.9), ai.dezifi:dezifi-dak (>=0.1.0-beta.1, <=0.1.0) +6429 more potentially affected by CVE-2026-59889 via com.fasterxml.jackson.core:jackson-databind (2.22.0)

com.fasterxml.jackson.core:jackson-databind MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.jackson.core:jackson-databind and may be impacted: - ai.covia:covia-discord =0.9.8, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0,...

ac.pao:reports-java-engine (1.0.0), africa.mailhive:mailhive-java (0.1.0) +24443 more potentially affected by CVE-2026-59889 via com.fasterxml.jackson.core:jackson-databind (>=2.18.0, <=2.18.8)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.18.0, =1.0.0, =0.1.0-alpha.1, =0.1.1, =0.1.3, =0.21.0-alpha.1, =0.86.0, =0.86.0, =0.5.0, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm-spring-boot-starter 0.1.0 and more Source cves:...

ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin (>=0.7.24, <=0.7.25), ai.pipestream:quarkus-buf-grpc-generator (>=0.7.24, <=0.7.25) +1377 more potentially affected by CVE-2026-59889 via tools.jackson.core:jackson-databind (3.2.0)

tools.jackson.core:jackson-databind MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tools.jackson.core:jackson-databind and may be impacted: - ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin =0.7.24, =0.7.2...

ac.pao:reports-java-engine (1.0.0), africa.mailhive:mailhive-java (0.1.0) +24443 more potentially affected by CVE-2026-59889 via com.fasterxml.jackson.core:jackson-databind (>=2.18.0, <=2.18.8)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.18.0, =1.0.0, =0.1.0-alpha.1, =0.1.1, =0.1.3, =0.21.0-alpha.1, =0.86.0, =0.86.0, =0.5.0, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm-spring-boot-starter 0.1.0 and more Source cves:...

ai.covia:covia-discord (>=0.9.8, <=0.9.9), ai.dezifi:dezifi-dak (>=0.1.0-beta.1, <=0.1.0) +6429 more potentially affected by CVE-2026-59889 via com.fasterxml.jackson.core:jackson-databind (2.22.0)

com.fasterxml.jackson.core:jackson-databind MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.jackson.core:jackson-databind and may be impacted: - ai.covia:covia-discord =0.9.8, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0,...

ai.abkr.open:any (>=1.0.6, <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +10376 more potentially affected by CVE-2026-59889 via tools.jackson.core:jackson-databind (>=3.0.0, <=3.1.4)

tools.jackson.core:jackson-databind MAVEN version =3.0.0, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0-alpha.4 -...

CVE-2026-59889 jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, UnwrappedPropertyHandler.processUnwrapped replays buffered JSON for a @JsonUnwrapped property and calls...

ac.pao:reports-java-engine (1.0.0), africa.mailhive:mailhive-java (0.1.0) +24443 more potentially affected by CVE-2026-59889 via com.fasterxml.jackson.core:jackson-databind (>=2.18.0, <=2.18.8)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.18.0, =1.0.0, =0.1.0-alpha.1, =0.1.1, =0.1.3, =0.21.0-alpha.1, =0.86.0, =0.86.0, =0.5.0, =0.6.0 - ai.ancf.lmos:lmos-router-hybrid-spring-boot-starter 0.1.0 - ai.ancf.lmos:lmos-router-llm-spring-boot-starter 0.1.0 and more Source cves:...

ai.covia:covia-discord (>=0.9.8, <=0.9.9), ai.dezifi:dezifi-dak (>=0.1.0-beta.1, <=0.1.0) +6429 more potentially affected by CVE-2026-59889 via com.fasterxml.jackson.core:jackson-databind (2.22.0)

com.fasterxml.jackson.core:jackson-databind MAVEN version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on com.fasterxml.jackson.core:jackson-databind and may be impacted: - ai.covia:covia-discord =0.9.8, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0,...

ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin (>=0.7.24, <=0.7.25), ai.pipestream:quarkus-buf-grpc-generator (>=0.7.24, <=0.7.25) +1377 more potentially affected by CVE-2026-59889 via tools.jackson.core:jackson-databind (3.2.0)

tools.jackson.core:jackson-databind MAVEN version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on tools.jackson.core:jackson-databind and may be impacted: - ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin =0.7.24, =0.7.2...