CVE-2026-91777

A flaw was found in FasterXML jackson-databind. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing specially crafted JSON input to an application that deserializes it into an identity-enabled collection or map. The flaw occurs due to inefficient processing of forward-references, where the system performs a quadratic amount of work for linearly growing input, leading to excessive CPU consumption.

A flaw was found in jackson-databind. Forward-reference completion for @JsonIdentityInfo object IDs in CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer performs a linear scan of the pending-reference accumulator for every resolved ID.

When a document creates unresolved object-ID references in an identity-enabled collection or map and then defines those IDs in reverse order, completion performs quadratic CPU work, allowing an attacker to cause a Denial of Service by sending specially crafted JSON input.

Exploitation requires an application that deserializes attacker-influenced JSON into an @JsonIdentityInfo-annotated collection or map.

The fix replaces the repeated linear lookup with a keyed pending-reference structure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to a patched version. Refer to the advisory for the patched versions: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24.

Example pom.xml:

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.18.11</version>
</dependency>

Verify: mvn dependency:tree -Dincludes=com.fasterxml.jackson.core:jackson-databind

If you cannot upgrade directly, apply defense-in-depth mitigations:

• Restrict JSON request size
• Audit and remove unnecessary @JsonIdentityInfo