CVE-2026-59888 is a medium severity vulnerability (CVSS 6.5) in jackson-databind affecting versions from 2.15.0 until fixed in 2.18.8, 2.21.4, and 3.1.4. The flaw involves improper control of dynamically-determined object attributes (CWE-915). Specifically, when using Java Records with a PropertyNamingStrategy, the @JsonIgnore annotation can be bypassed because the POJOPropertiesCollector records ignored components under their original implicit names before applying the naming strategy. This allows the renamed JSON key to be assigned to the Record constructor parameter, potentially leading to unintended data binding behavior. No known exploits in the wild have been reported. No explicit vendor remediation level or patch links are provided, but fixed versions are clearly stated.

The vulnerability allows bypassing the @JsonIgnore annotation in certain jackson-databind versions, which can lead to unintended assignment of JSON keys to Java Record constructor parameters. This may result in exposure or modification of data that was intended to be ignored during deserialization. The impact is limited to confidentiality and integrity (C:L/I:L) with no availability impact. The attack vector is network-based with low attack complexity and no privileges or user interaction required.

Fixed versions are available: upgrade jackson-databind to version 2.18.8 or later, 2.21.4 or later, or 3.1.4 or later. Since the vulnerability is fixed in these versions, applying these updates will remediate the issue. Patch status is confirmed by the version information in the description. No additional vendor advisory content is provided, so check official FasterXML jackson-databind release notes for confirmation and further guidance.