CVE-2026-91777 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in com.fasterxml.jackson.core:jackson-databind. A fix is available for com.fasterxml.jackson.core:jackson-databind — see the affected versions and patch details below.
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-91777.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-91777 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,415 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
com.fasterxml.jackson.core:jackson-databind☕tools.jackson.core:jackson-databind☕tools.jackson.core:jackson-databind☕com.fasterxml.jackson.core:jackson-databind☕com.fasterxml.jackson.core:jackson-databindReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Summary
When an @JsonIdentityInfo collection or map first creates N unresolved
object-ID references and later resolves the same IDs in reverse order,
jackson-databind scans the remaining pending-reference accumulator for each
resolution. A shallow JSON document whose size grows linearly can therefore
cause quadratic CPU work during deserialization.
Details
The affected path is forward-reference completion in
CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()
and the corresponding map implementation. The implementation performs a
linear search of the pending accumulator for every resolved object ID.
The behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and 3.2.1. Current 2.22 and 3.2 source branches retained the same design when rechecked. A 2.4.0 control fails closed before successful reverse-order completion, so 2.5.0 is the conservative runtime-confirmed affected floor. The patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.
The vulnerable application must deserialize attacker-influenced JSON into an identity-enabled collection or map. The issue does not require deep nesting or syntactically unusual JSON.
Suggested correction: replace repeated linear lookup/removal with a keyed pending-reference structure or another design that provides linear or amortized-linear completion. A regression should preserve input order, duplicate-ID behavior, and unresolved-ID errors while bounding reverse-order resolution work.
PoC
The proof constructs a shallow collection containing N unresolved
@JsonIdentityInfo references followed by definitions of those same IDs in
reverse order. Its ID class counts equals() calls, giving a deterministic
work measure rather than a timing-dependent result.
With N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An
equally sized control in which every reference is already resolved performs
zero comparisons in the pending-reference lookup path. The run is bounded to
a 512 MiB JVM. The result demonstrates quadratic growth: approximately
N * (N + 1) / 2 comparisons, plus fixed setup comparisons.
Impact
An unauthenticated source that can submit JSON to an application using the affected identity-enabled collection or map shape can consume quadratic CPU and exhaust a request-time or worker-capacity budget, causing denial of service. The application model/configuration prerequisite is material. No confidentiality, integrity, code-execution, or parser-depth impact is claimed.
Requested credit: Daniel Birtwhistle
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.fasterxml.jackson.core:jackson-databind | ≥ 2.19.0&&< 2.21.7 | 2.21.7com.fasterxml.jackson.core:jackson-databind:2.21.7 |
| ☕Maven | tools.jackson.core:jackson-databind | ≥ 3.0.0&&< 3.1.7 | 3.1.7tools.jackson.core:jackson-databind:3.1.7 |
| ☕Maven | tools.jackson.core:jackson-databind | ≥ 3.2.0&&< 3.2.3 | 3.2.3tools.jackson.core:jackson-databind:3.2.3 |
| ☕Maven | com.fasterxml.jackson.core:jackson-databind | ≥ 2.5.0&&< 2.18.11 | 2.18.11com.fasterxml.jackson.core:jackson-databind:2.18.11 |
| ☕Maven | com.fasterxml.jackson.core:jackson-databind | ≥ 2.22.0&&< 2.22.3 | 2.22.3com.fasterxml.jackson.core:jackson-databind:2.22.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.fasterxml.jackson.core:jackson-databind, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.fasterxml.jackson.core:jackson-databind to 2.21.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-91777 is resolved across your whole dependency graph.
Workarounds
Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
A flaw was found in jackson-databind. Forward-reference completion for `@JsonIdentityInfo` object IDs in `CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()` and the equivalent implementation in `MapDeserializer` performs a linear scan of the pending-reference accumulator for every…
Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24. Example `pom.xml`: ``` <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.18.11</version> </dependency> ``` Verify: `mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind` If you cannot upgrade directly, apply defense-in-depth mitigations: - Restrict JSON request size - Audit and remove unnecessary @JsonIdentityInfoSource: Red Hat security advisory for CVE-2026-91777 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| Red Hat build of Quarkus 3.27.6.redhat | com.fasterxml.jackson.core/jackson-databind:2.21.7.redhat-00001 | RHSA-2026:83082 |
| Red Hat build of Quarkus 3.33.4.redhat | com.fasterxml.jackson.core/jackson-databind:2.21.7.redhat-00001 | RHSA-2026:83520 |
| Red Hat Enterprise Linux 9 | jackson-databind-0:2.21.6-1.el9_8.1 | RHSA-2026:85231 |
| OpenShift Developer Tools and Services 4.12 | ocp-tools-4/jenkins-rhel8:1792044326 | RHSA-2026:88152 |
| OpenShift Developer Tools and Services 4.13 | ocp-tools-4/jenkins-rhel8:1792044327 | RHSA-2026:88149 |
| OpenShift Developer Tools and Services 4.14 | ocp-tools-4/jenkins-rhel8:1792044382 | RHSA-2026:88151 |
| OpenShift Developer Tools and Services 4.15 | ocp-tools-4/jenkins-rhel8:1792044386 | RHSA-2026:88150 |
| OpenShift Developer Tools and Services 4.16 | ocp-tools-4/jenkins-rhel9:1792040287 | RHSA-2026:88156 |
Frequently Asked Questions
Is CVE-2026-91777 in your dependencies?
Find it across Maven, including transitive dependencies.