Threats Tagged 'cve-2026-59889'

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing a range of vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These vulnerabilities affect various components including Jackson libraries, Netty, Bouncy Castle, Undertow, Artemis server, Apache CXF, WildFly Elytron, and others. The update replaces version 8.1.7 and is intended to mitigate these issues in Red Hat JBoss EAP 8.1 for RHEL 8.

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing vulnerabilities such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These vulnerabilities affect various components including Jackson libraries, Netty, Bouncy Castle, Undertow, Apache CXF, Artemis server, WildFly Elytron, and others. The update replaces version 8.1.7 and is intended to mitigate these issues by applying patches and enhancements.

Red Hat JBoss Enterprise Application Platform 8.1.8 includes multiple security fixes addressing vulnerabilities such as denial of service, privilege escalation, arbitrary code execution, authentication bypass, information disclosure, and resource exhaustion. These issues affect various components including Jackson libraries, Netty codecs, Bouncy Castle, Undertow, Artemis server, Apache CXF, WildFly Elytron, and others. The update replaces version 8.1.7 and is rated as having an important security impact by Red Hat. Users are advised to apply this update to mitigate these vulnerabilities.

Red Hat has released a security update for JBoss Enterprise Application Platform 7.4 addressing multiple vulnerabilities including unauthenticated queue creation and session hijacking in Apache Artemis, as well as privilege escalation and unexpected property modification issues in jackson-databind. These vulnerabilities affect Red Hat JBoss EAP 7.4 versions for RHEL 7, 8, and 9. The update is rated as important by Red Hat Product Security.

Gradle version 9.7.1-r0 addresses three security vulnerabilities including CVE-2026-59889. The update fixes issues present in versions prior to 9.7.1-r0. No specific technical details or CVSS scores are provided for these vulnerabilities. There are no known exploits in the wild at this time.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 addressing multiple vulnerabilities across a wide range of Oracle Database products and related software. The update includes 943 security patches targeting Oracle Database Server, Essbase, Autonomous Health Framework, Application Testing Suite, and many other Oracle product families. The vulnerabilities include issues classified under CWE-770, CWE-416, CWE-476, and CWE-863. Oracle strongly recommends applying these patches promptly to mitigate risks, as some vulnerabilities have been subject to attempted exploitation in the wild. The advisory emphasizes staying on actively supported versions and applying patches without delay.

CVE-2026-59889 is an authorization bypass vulnerability in FasterXML jackson-databind affecting versions prior to 2.21.5, 2.22.1, 3.1.5, and 3.2.1. It occurs because the processUnwrapped() method does not enforce the @JsonView authorization guard on container properties annotated with @JsonUnwrapped, allowing attacker-controlled JSON to overwrite privileged fields under a more restrictive view. This can lead to write-side mass-assignment and privilege escalation, such as an attacker assigning themselves admin roles or elevated privileges. The issue affects both 2.x and 3.x branches and variants including nested unwrapped properties and builder-based deserializers. A patch is available that adds the missing view guard to processUnwrapped(), closing all known bypass variants.

This security update addresses multiple vulnerabilities in jackson-annotations, jackson-core, and jackson-databind libraries. The issues include bypasses of @JsonIgnoreProperties exclusions, unauthorized writes to @JsonView restricted fields due to missing view guards, and bypasses of @JsonIgnore restrictions on Java Records caused by mismatches in property renaming and ignore-filtering. The update advances all three components to version 2.18.9, which includes fixes for these vulnerabilities.

A vulnerability in FasterXML jackson-databind versions from 2.15.0 up to but not including 2.18.8, 2.21.4, and 3.1.4 allows Java Records using a PropertyNamingStrategy to bypass the @JsonIgnore annotation. This occurs because the ignored component is recorded under its original name before the naming strategy renames the JSON key, enabling assignment to the Record constructor parameter. The issue is fixed starting from versions 2.18.8, 2.21.4, and 3.1.4.