{"schema":"threatline.record/2","record":{"id":"CVE-2026-91776","aliases":["GHSA-wv8q-qhhj-9h54"],"summary":"jackson-databind retains every unknown raw type ID ","details":"### Summary\n\nWith `@JsonTypeInfo(use = Id.NAME, defaultImpl = ...)`, every distinct unknown\nraw type ID selects the same fallback deserializer but is retained as a\nseparate key in `TypeDeserializerBase._deserializers`. An attacker who can\nrepeatedly supply new unknown type IDs can grow this process-lifetime cache\nwithout a configured bound.\n\n### Details\n\nThe affected path is `TypeDeserializerBase._findDeserializer()`. After an\nunknown name-based type ID resolves to the configured fallback/default\nimplementation, jackson-databind caches the result under the attacker-provided\nraw `typeId`. Although all such IDs select the same fallback deserializer, each\nnew string remains a distinct cache key.\n\nThe behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.\nCurrent 2.22 and 3.2 source branches retained the unbounded `_deserializers`\nmap and per-raw-ID cache write when rechecked. The earlier affected floor has\nnot been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must enable name-based polymorphism with a\n`defaultImpl` or equivalent fallback, accept attacker-influenced type IDs, and\nreuse a long-lived mapper/type deserializer across requests.\n\nSuggested correction: avoid caching each unknown raw ID when every such ID\nresolves to the same fallback, use a fallback sentinel, or use an explicitly\nbounded concurrency-safe cache. A regression should contrast many distinct\nunknown IDs with repetitions of one unknown ID across requests.\n\n### PoC\n\nConfigure a polymorphic base type with\n`@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class)` and\ndeserialize inputs containing unknown type names through the same mapper.\nInspect `TypeDeserializerBase._deserializers` after the run.\n\nOn affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce\n10,000 retained cache entries even though every input selects the same\nfallback deserializer. A matched control that repeats one unknown ID 10,000\ntimes produces one retained entry. This isolates attacker-controlled key\ncardinality from ordinary request count.\n\n### Impact\n\nWhere the stated polymorphic fallback configuration is exposed to\nattacker-influenced type IDs, distinct inputs cause incremental\nprocess-lifetime memory retention and eventual availability pressure or\ndenial of service. This is not claimed as a single-request allocation spike,\nand no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No\nconfidentiality, integrity, or code-execution impact is claimed.\n\nRequested credit: Daniel Birtwhistle","categories":["Libraries & packages"],"product":"com.fasterxml.jackson.core:jackson-databind","vendor":"FasterXML","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.0.0, <= 2.18.10"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.19.0, <= 2.21.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.22.0, <= 2.22.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"range":">= 3.0.0, <= 3.1.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"range":">= 3.2.0, <= 3.2.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91776","source_modified_at":"2026-09-23T14:03:16.129Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"jackson-databind","vendor":"FasterXML","versions":[{"status":"affected","version":"2.0.0","lessThanOrEqual":"2.18.10","versionType":"maven"},{"status":"affected","version":"2.19.0","lessThanOrEqual":"2.21.6","versionType":"maven"},{"status":"affected","version":"2.22.0","lessThanOrEqual":"2.22.2","versionType":"maven"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91776","source_modified_at":"2026-09-23T14:03:16.129Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"jackson-databind","vendor":"FasterXML","versions":[{"status":"affected","version":"3.0.0","lessThanOrEqual":"3.1.6","versionType":"maven"},{"status":"affected","version":"3.2.0","lessThanOrEqual":"3.2.2","versionType":"maven"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.18.11"}],"type":"ECOSYSTEM"}],"versions":["2.0.0","2.0.1","2.0.2","2.0.4","2.0.5","2.0.6","2.1.0","2.1.1","2.1.2","2.1.3","2.1.4","2.1.5","2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"2.19.0"},{"fixed":"2.21.7"}],"type":"ECOSYSTEM"}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.21.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"2.22.0"},{"fixed":"2.22.3"}],"type":"ECOSYSTEM"}],"versions":["2.22.0","2.22.1","2.22.2"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.1.7"}],"type":"ECOSYSTEM"}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"events":[{"introduced":"3.2.0"},{"fixed":"3.2.3"}],"type":"ECOSYSTEM"}],"versions":["3.2.0","3.2.1","3.2.2"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.18.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.21.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.22.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"version":"3.1.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:36:57Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"version":"3.2.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.18.11"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.21.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"com.fasterxml.jackson.core:jackson-databind","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.22.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"version":"3.1.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","source_modified_at":"2026-09-30T15:46:18.451708212Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"Maven","name":"tools.jackson.core:jackson-databind","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"version":"3.2.3"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0045,"percentile":0.38163,"score_date":"2026-10-23"},"published_at":"2026-09-23T02:17:50.480Z","modified_at":"2026-09-30T15:46:18.451708212Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T15:36:57Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-91776","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-23T14:03:16.129Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-wv8q-qhhj-9h54","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T15:46:18.451708212Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91776","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91776","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/issues/6203","tags":["patch"]},{"url":"https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-wv8q-qhhj-9h54","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-23T14:02:42.582789Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T15:46:18.451708212Z","content_hash":"1d415440a16b4cf00dd29350aa564489f2f8956289264b7380e7409df0151e7a"}}