CVE-2026-91776

A flaw was found in jackson-databind. A remote attacker can exploit this vulnerability by repeatedly supplying distinct, unrecognized type identifiers to an application configured with name-based polymorphism and a fallback deserializer. This action causes the TypeDeserializerBase component to retain every unknown type ID in an unbounded cache, leading to monotonic memory consumption. Over time, this uncontrolled resource consumption can result in a Denial of Service (DoS) due to memory exhaustion.

Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can exhaust Java Virtual Machine memory, leading to a complete denial of service for the hosting service without requiring elevated permissions. Exploitation depends on applications accepting untrusted input and exposing polymorphic deserialization configured with a default fallback implementation across long-lived mapper instances. In typical Red Hat deployments, polymorphic handling with fallback deserializers is not the default configuration, substantially narrowing the exposure to custom or specifically configured workloads.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.