CVE-2026-91777
published 2026-09-23CVE-2026-91777: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.45%
37.7th percentile
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.
Affected
52 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-24 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel8 | — | — |
| ansible-automation-platform-25 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-26 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-minimal-rhel9 | — | — |
| ansible-automation-platform-27 | de-supported-rhel9 | — | — |
| candlepinproject | candlepin | — | — |
| debian | dogtag-pki | — | — |
| debian | puppetserver | — | — |
| devspaces | multicluster-redirector-rhel9 | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| devspaces | server-rhel9 | — | — |
| exploit-intelligence | agent-client-rhel9 | — | — |
| fasterxml | jackson-databind | — | — |
| fasterxml | jackson-databind | 2.19.0 – 2.21.6 | — |
| fasterxml | jackson-databind | 2.22.0 – 2.22.2 | — |
| fasterxml | jackson-databind | 2.5.0 – 2.18.10 | — |
| fasterxml | jackson-databind | 3.0.0 – 3.1.6 | — |
| fasterxml | jackson-databind | 3.2.0 – 3.2.2 | — |
| jboss-eap-7 | eap74-els-openjdk11-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk17-openshift-rhel8 | — | — |
| jboss-eap-7 | eap74-els-openjdk8-openshift-rhel8 | — | — |
| jboss-webserver-7 | jws70-openjdk17-openshift-rhel9 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
jackson-databind quadratic forward-reference completion
ghsa·2026-09-30
CVE-2026-91777 [HIGH] CWE-400 jackson-databind quadratic forward-reference completion
jackson-databind quadratic forward-reference completion
### Summary
When an `@JsonIdentityInfo` collection or map first creates N unresolved
object-ID references and later resolves the same IDs in reverse order,
jackson-databind scans the remaining pending-reference accumulator for each
resolution. A shallow JSON document whose size grows linearly can therefore
cause quadratic CPU work during deserialization.
### Details
The affected path is forward-reference completion in
`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`
and the corresponding map implementation. The implementation performs a
linear search of the pending accumulator for every resolved object ID.
The behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and
3.2.1. Current 2.22
VulDB
FasterXML jackson-databind Forward Reference Completion resource consumption (EUVD-2026-85003 / WID-SEC-2026-3532)
vuldb·2026-09-23·CVSS 7.5
CVE-2026-91777 [HIGH] FasterXML jackson-databind Forward Reference Completion resource consumption (EUVD-2026-85003 / WID-SEC-2026-3532)
A vulnerability classified as problematic was found in FasterXML jackson-databind. The impacted element is the function CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference of the component Forward Reference Completion. Such manipulation leads to resource consumption.
This vulnerability is referenced as CVE-2026-91777. It is possible to launch the attack remotely. No exploit is available.
Red Hat
com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
vendor_redhat·2026-09-23·CVSS 7.5
CVE-2026-91777 [HIGH] CWE-606 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter ins
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-91777 jackson-core: Jackson-databind: Denial of Service via quadratic forward-reference completion [fedora-all]
bugzilla·2026-10-15·CVSS 7.5
CVE-2026-91777 [HIGH] CVE-2026-91777 jackson-core: Jackson-databind: Denial of Service via quadratic forward-reference completion [fedora-all]
CVE-2026-91777 jackson-core: Jackson-databind: Denial of Service via quadratic forward-reference completion [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines
Bugzilla
CVE-2026-91777 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
bugzilla·2026-09-23·CVSS 7.5
CVE-2026-91777 [HIGH] CVE-2026-91777 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
CVE-2026-91777 com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. T
2026-09-23
Published