CVE-2026-91776
Received Received - Intake

Memory Leak in FasterXML jackson-databind

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: HeroDevs

Description
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-91776
EUVD
EUVD-2026-85002

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
fasterxml jackson-databind From 2.0.0 (inc) to 2.18.11 (exc)
fasterxml jackson-databind From 2.19.0 (inc) to 2.21.7 (exc)
fasterxml jackson-databind From 2.22.0 (inc) to 2.22.3 (exc)
fasterxml jackson-databind From 3.0.0 (inc) to 3.1.7 (exc)
fasterxml jackson-databind From 3.2.0 (inc) to 3.2.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a memory leak vulnerability in the Jackson Databind library where the TypeDeserializer caches every distinct unknown type ID indefinitely. Attackers can exploit this by sending numerous unique type IDs, causing unbounded memory growth as each ID is stored in the _deserializers map. The cache has no size limit and persists for the lifetime of the type deserializer.

Detection Guidance

To detect this vulnerability, monitor memory usage for unbounded growth in applications using Jackson Databind with name-based polymorphism enabled. Check for repeated caching of unique type IDs in logs or via profiling tools. No specific commands are provided in the context, but inspecting heap dumps or using JVM monitoring tools like VisualVM or JConsole may help identify excessive cache entries.

Impact Analysis

An attacker could exploit this to cause a denial of service by flooding the application with requests containing unique type IDs. This leads to excessive memory consumption, potentially crashing the application or degrading performance. The impact is highest if the application uses name-based polymorphism with a fallback and reuses a long-lived ObjectMapper.

Compliance Impact

This vulnerability primarily impacts availability due to unbounded memory consumption, which could lead to denial-of-service conditions. While not directly violating GDPR or HIPAA, such disruptions may indirectly affect compliance by impairing system functionality required for data processing or access. Organizations must ensure robust availability controls to maintain regulatory adherence.

Mitigation Strategies
  • Upgrade Jackson Databind to a patched version (2.18.11, 2.21.7, 2.22.3, 3.1.7, or 3.2.3) to apply the fix that bounds cache size and limits type ID length.
  • Disable caching of fallback deserializers or configure a bounded cache manually if upgrading is not immediately possible.
  • Avoid using name-based polymorphism with defaultImpl or equivalent fallback in untrusted input scenarios until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart