Vulnerabilities in pkg:maven/com.fasterxml.jackson.core/jackson-databind

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-cxp5-3px4-pw24",
  "modified" : "2026-09-30T15:37:24Z",
  "published" : "2026-09-30T15:37:24Z",
  "aliases" : [ "CVE-2026-91777" ],
  "summary" : "jackson-databind quadratic forward-reference completion ",
  "details" : "### Summary\n\nWhen an `@JsonIdentityInfo` collection or map first creates N unresolved\nobject-ID references and later resolves the same IDs in reverse order,\njackson-databind scans the remaining pending-reference accumulator for each\nresolution. A shallow JSON document whose size grows linearly can therefore\ncause quadratic CPU work during deserialization.\n\n### Details\n\nThe affected path is forward-reference completion in\n`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`\nand the corresponding map implementation. The implementation performs a\nlinear search of the pending accumulator for every resolved object ID.\n\nThe behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and\n3.2.1. Current 2.22 and 3.2 source branches retained the same design when\nrechecked. A 2.4.0 control fails closed before successful reverse-order\ncompletion, so 2.5.0 is the conservative runtime-confirmed affected floor.\nThe patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must deserialize attacker-influenced JSON into an\nidentity-enabled collection or map. The issue does not require deep nesting or\nsyntactically unusual JSON.\n\nSuggested correction: replace repeated linear lookup/removal with a keyed\npending-reference structure or another design that provides linear or\namortized-linear completion. A regression should preserve input order,\nduplicate-ID behavior, and unresolved-ID errors while bounding reverse-order\nresolution work.\n\n### PoC\n\nThe proof constructs a shallow collection containing N unresolved\n`@JsonIdentityInfo` references followed by definitions of those same IDs in\nreverse order. Its ID class counts `equals()` calls, giving a deterministic\nwork measure rather than a timing-dependent result.\n\nWith N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An\nequally sized control in which every reference is already resolved performs\nzero comparisons in the pending-reference lookup path. The run is bounded to\na 512 MiB JVM. The result demonstrates quadratic growth: approximately\n`N * (N + 1) / 2` comparisons, plus fixed setup comparisons.\n\n### Impact\n\nAn unauthenticated source that can submit JSON to an application using the\naffected identity-enabled collection or map shape can consume quadratic CPU\nand exhaust a request-time or worker-capacity budget, causing denial of\nservice. The application model/configuration prerequisite is material. No\nconfidentiality, integrity, code-execution, or parser-depth impact is claimed.\n\nRequested credit: Daniel Birtwhistle",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.fasterxml.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.19.0"
      }, {
        "fixed" : "2.21.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.21.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "tools.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.0.0"
      }, {
        "fixed" : "3.1.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.1.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "tools.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "3.2.0"
      }, {
        "fixed" : "3.2.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 3.2.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.fasterxml.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.5.0"
      }, {
        "fixed" : "2.18.11"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.18.10"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "com.fasterxml.jackson.core:jackson-databind"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.22.0"
      }, {
        "fixed" : "2.22.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.22.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-91777"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/issues/6204"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/pull/6204"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/FasterXML/jackson-databind"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-30T15:37:24Z",
    "nvd_published_at" : "2026-09-23T03:17:04Z"
  }
}