CVE-2026-91777 is a high-severity (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in com.fasterxml.jackson.core:jackson-databind. A fix is available for com.fasterxml.jackson.core:jackson-databind — see the affected versions and patch details below.
jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-91777.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-91777 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 384,189 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
com.fasterxml.jackson.core:jackson-databind☕tools.jackson.core:jackson-databind☕tools.jackson.core:jackson-databind☕com.fasterxml.jackson.core:jackson-databind☕com.fasterxml.jackson.core:jackson-databindReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.
Description
Summary
When an @JsonIdentityInfo collection or map first creates N unresolved
object-ID references and later resolves the same IDs in reverse order,
jackson-databind scans the remaining pending-reference accumulator for each
resolution. A shallow JSON document whose size grows linearly can therefore
cause quadratic CPU work during deserialization.
Details
The affected path is forward-reference completion in
CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()
and the corresponding map implementation. The implementation performs a
linear search of the pending accumulator for every resolved object ID.
The behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and 3.2.1. Current 2.22 and 3.2 source branches retained the same design when rechecked. A 2.4.0 control fails closed before successful reverse-order completion, so 2.5.0 is the conservative runtime-confirmed affected floor. The patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.
The vulnerable application must deserialize attacker-influenced JSON into an identity-enabled collection or map. The issue does not require deep nesting or syntactically unusual JSON.
Suggested correction: replace repeated linear lookup/removal with a keyed pending-reference structure or another design that provides linear or amortized-linear completion. A regression should preserve input order, duplicate-ID behavior, and unresolved-ID errors while bounding reverse-order resolution work.
PoC
The proof constructs a shallow collection containing N unresolved
@JsonIdentityInfo references followed by definitions of those same IDs in
reverse order. Its ID class counts equals() calls, giving a deterministic
work measure rather than a timing-dependent result.
With N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An
equally sized control in which every reference is already resolved performs
zero comparisons in the pending-reference lookup path. The run is bounded to
a 512 MiB JVM. The result demonstrates quadratic growth: approximately
N * (N + 1) / 2 comparisons, plus fixed setup comparisons.
Impact
An unauthenticated source that can submit JSON to an application using the affected identity-enabled collection or map shape can consume quadratic CPU and exhaust a request-time or worker-capacity budget, causing denial of service. The application model/configuration prerequisite is material. No confidentiality, integrity, code-execution, or parser-depth impact is claimed.
Requested credit: Daniel Birtwhistle
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| ☕Maven | com.fasterxml.jackson.core:jackson-databind | ≥ 2.19.0&&< 2.21.7 | 2.21.7com.fasterxml.jackson.core:jackson-databind:2.21.7 |
| ☕Maven | tools.jackson.core:jackson-databind | ≥ 3.0.0&&< 3.1.7 | 3.1.7tools.jackson.core:jackson-databind:3.1.7 |
| ☕Maven | tools.jackson.core:jackson-databind | ≥ 3.2.0&&< 3.2.3 | 3.2.3tools.jackson.core:jackson-databind:3.2.3 |
| ☕Maven | com.fasterxml.jackson.core:jackson-databind | ≥ 2.5.0&&< 2.18.11 | 2.18.11com.fasterxml.jackson.core:jackson-databind:2.18.11 |
| ☕Maven | com.fasterxml.jackson.core:jackson-databind | ≥ 2.22.0&&< 2.22.3 | 2.22.3com.fasterxml.jackson.core:jackson-databind:2.22.3 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.fasterxml.jackson.core:jackson-databind, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.fasterxml.jackson.core:jackson-databind to 2.21.7 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-91777 is resolved across your whole dependency graph.
Workarounds
Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.
Frequently Asked Questions
Is CVE-2026-91777 in your dependencies?
Find it across Maven, including transitive dependencies.