PatchSiren analyzed CVE-2026-59889, a vulnerability in jackson-databind's UnwrappedPropertyHandler. This issue allows attackers to write properties under a less-privileged active view. The vulnerability affects jackson-databind versions between 2.18.0 and 2.18.8, 2.21.4 and earlier, 2.22.0, 3.1.4 and earlier, and 3.2.0. Developers and security teams should prioritize patching to mitigate this vulnerability.
CVE-2026-29062 is a high-severity vulnerability in Jackson-Core, a popular Java library for processing JSON data. The vulnerability allows for a Denial of Service (DoS) attack due to a bypass of the maxNestingDepth constraint in the UTF8DataInputJsonParser and ReaderBasedJsonParser. This can be exploited by supplying a JSON document with excessive nesting, leading to a StackOverflowError. The issue has be [truncated]
