CVE-2026-91777
Received Received - Intake

Inefficient Forward-Reference Resolution in Jackson-Databind

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: HeroDevs

Description
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-91777
EUVD
EUVD-2026-85003

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
fasterxml jackson-databind to 2.18.11 (exc)
fasterxml jackson-databind to 2.21.7 (exc)
fasterxml jackson-databind to 2.22.3 (exc)
fasterxml jackson-databind to 3.1.7 (exc)
fasterxml jackson-databind to 3.2.3 (exc)
fasterxml jackson-databind 2.18.11
fasterxml jackson-databind 2.21.7
fasterxml jackson-databind 2.22.3
fasterxml jackson-databind 3.1.7
fasterxml jackson-databind 3.2.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial-of-service issue in FasterXML jackson-databind's Collection and Map deserializers. It occurs when resolving forward references (using @JsonIdentityInfo) in reverse order, causing the deserializers to perform O(N²) operations instead of O(N). Pending references are stored in a list that is scanned linearly for each resolution, leading to quadratic CPU work during deserialization.

Detection Guidance

This vulnerability is specific to applications using FasterXML jackson-databind with @JsonIdentityInfo annotations in collections or maps. Detection requires checking if your application uses vulnerable versions (2.5.0-2.18.10, 2.19.0-2.21.6, 2.22.0-2.22.2, 3.0.0-3.1.6, or 3.2.0-3.2.2) and processes attacker-controlled JSON with unresolved forward references. No direct network detection commands exist, but you can verify library versions and monitor CPU usage during JSON deserialization.

Impact Analysis

This vulnerability can cause significant CPU resource exhaustion, leading to denial-of-service conditions. Attackers can exploit it by submitting specially crafted JSON documents to applications using identity-enabled collections or maps, potentially disrupting service availability without requiring authentication or special privileges.

Compliance Impact

This vulnerability primarily causes denial-of-service through CPU exhaustion, which may impact availability of systems processing affected JSON data. Standards like GDPR and HIPAA require maintaining system availability and protecting personal data, so prolonged outages could potentially lead to compliance issues if they disrupt data processing or access to critical systems.

Mitigation Strategies

Upgrade jackson-databind to a patched version (2.18.11, 2.21.7, 2.22.3, 3.1.7, or 3.2.3) immediately. If upgrading is not possible, disable @JsonIdentityInfo usage in collections/maps or restrict JSON input sources to trusted entities. Monitor CPU usage for signs of abnormal deserialization workloads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91777. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart