CVE-2026-91776: Jackson databind Jackson-databind Retains Every Unknown Raw Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wv8q-qhhj-9h54",
  "modified" : "2026-09-30T15:36:55Z",
  "published" : "2026-09-30T15:36:55Z",
  "aliases" : [ "CVE-2026-91776" ],
  "summary" : "jackson-databind retains every unknown raw type ID ",
  "details" : "### Summary\n\nWith `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown\nraw type ID selects the same fallback deserializer but is retained as a\nseparate key in `TypeDeserializerBase._deserializers`. An attacker who can\nrepeatedly supply new unknown type IDs can grow this process-lifetime cache\nwithout a configured bound.\n\n### Details\n\nThe affected path is `TypeDeserializerBase._findDeserializer()`. After an\nunknown name-based type ID resolves to the configured fallback/default\nimplementation, jackson-databind caches the result under the attacker-provided\nraw `typeId`. Although all such IDs select the same fallback deserializer, each\nnew string remains a distinct cache key.\n\nThe behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.\nCurrent 2.22 and 3.2 source branches retained the unbounded `_deserializers`\nmap and per-raw-ID cache write when rechecked. The earlier affected floor has\nnot been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must enable name-based polymorphism with a\n`defaultImpl` or equivalent fallback, accept attacker-influenced type IDs, and\nreuse a long-lived mapper/type deserializer across requests.\n\nSuggested correction: avoid caching each unknown raw ID when every such ID\nresolves to the same fallback, use a fallback sentinel, or use an explicitly\nbounded concurrency-safe cache. A regression should contrast many distinct\nunknown IDs with repetitions of one unknown ID across requests.\n\n### PoC\n\nConfigure a polymorphic base type with\n`@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class)` and\ndeserialize inputs containing unknown type names through the same mapper.\nInspect `TypeDeserializerBase._deserializers` after the run.\n\nOn affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce\n10,000 retained cache entries even though every input selects the same\nfallback deserializer. A matched control that repeats one unknown ID 10,000\ntimes produces one retained entry. This isolates attacker-controlled key\ncardinality from ordinary request count.\n\n### Impact\n\nWhere the stated polymorphic fallback configuration is exposed to\nattacker-influenced type IDs, distinct inputs cause incremental\nprocess-lifetime memory retention and eventual availability pressure or\ndenial of service. This is not claimed as a single-request allocation spike,\nand no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No\nconfidentiality, integrity, or code-execution impact is claimed.\n\nRequested credit: Daniel Birtwhistle",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.fasterxml.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.0.0"
      }, {
        "fixed" : "2.18.11"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.18.10"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.fasterxml.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.19.0"
      }, {
        "fixed" : "2.21.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.21.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.fasterxml.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.22.0"
      }, {
        "fixed" : "2.22.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.22.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "tools.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.1.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "tools.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.2.0"
      }, {
        "fixed" : "3.2.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.2.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-91776"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/issues/6203"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/FasterXML/jackson-databind"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-30T15:36:55Z",
    "nvd_published_at" : "2026-09-23T03:17:04Z"
  }
}