{"schema":"threatline.record/2","record":{"id":"CVE-2026-91777","aliases":["GHSA-cxp5-3px4-pw24"],"summary":"jackson-databind quadratic forward-reference completion ","details":"### Summary\n\nWhen an `@JsonIdentityInfo` collection or map first creates N unresolved\nobject-ID references and later resolves the same IDs in reverse order,\njackson-databind scans the remaining pending-reference accumulator for each\nresolution. A shallow JSON document whose size grows linearly can therefore\ncause quadratic CPU work during deserialization.\n\n### Details\n\nThe affected path is forward-reference completion in\n`CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()`\nand the corresponding map implementation. The implementation performs a\nlinear search of the pending accumulator for every resolved object ID.\n\nThe behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and\n3.2.1. Current 2.22 and 3.2 source branches retained the same design when\nrechecked. A 2.4.0 control fails closed before successful reverse-order\ncompletion, so 2.5.0 is the conservative runtime-confirmed affected floor.\nThe patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.\n\nThe vulnerable application must deserialize attacker-influenced JSON into an\nidentity-enabled collection or map. The issue does not require deep nesting or\nsyntactically unusual JSON.\n\nSuggested correction: replace repeated linear lookup/removal with a keyed\npending-reference structure or another design that provides linear or\namortized-linear completion. A regression should preserve input order,\nduplicate-ID behavior, and unresolved-ID errors while bounding reverse-order\nresolution work.\n\n### PoC\n\nThe proof constructs a shallow collection containing N unresolved\n`@JsonIdentityInfo` references followed by definitions of those same IDs in\nreverse order. Its ID class counts `equals()` calls, giving a deterministic\nwork measure rather than a timing-dependent result.\n\nWith N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An\nequally sized control in which every reference is already resolved performs\nzero comparisons in the pending-reference lookup path. The run is bounded to\na 512 MiB JVM. The result demonstrates quadratic growth: approximately\n`N * (N + 1) / 2` comparisons, plus fixed setup comparisons.\n\n### Impact\n\nAn unauthenticated source that can submit JSON to an application using the\naffected identity-enabled collection or map shape can consume quadratic CPU\nand exhaust a request-time or worker-capacity budget, causing denial of\nservice. The application model/configuration prerequisite is material. No\nconfidentiality, integrity, code-execution, or parser-depth impact is claimed.\n\nRequested credit: Daniel Birtwhistle","categories":["Libraries & packages"],"product":"com.fasterxml.jackson.core:jackson-databind","vendor":"FasterXML","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.19.0, <= 2.21.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"range":">= 3.0.0, <= 3.1.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"range":">= 3.2.0, <= 3.2.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.5.0, <= 2.18.10"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"range":">= 2.22.0, <= 2.22.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91777","source_modified_at":"2026-09-23T14:05:17.919Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"jackson-databind","vendor":"FasterXML","versions":[{"lessThanOrEqual":"2.18.10","status":"affected","version":"2.5.0","versionType":"maven"},{"lessThanOrEqual":"2.21.6","status":"affected","version":"2.19.0","versionType":"maven"},{"lessThanOrEqual":"2.22.2","status":"affected","version":"2.22.0","versionType":"maven"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-91777","source_modified_at":"2026-09-23T14:05:17.919Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"jackson-databind","vendor":"FasterXML","versions":[{"lessThanOrEqual":"3.1.6","status":"affected","version":"3.0.0","versionType":"maven"},{"lessThanOrEqual":"3.2.2","status":"affected","version":"3.2.0","versionType":"maven"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.21.7"}]}],"versions":["2.19.0","2.19.1","2.19.2","2.19.3","2.19.4","2.20.0","2.20.0-rc1","2.20.1","2.20.2","2.21.0","2.21.1","2.21.2","2.21.3","2.21.4","2.21.5","2.21.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"tools.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.1.7"}]}],"versions":["3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.0-rc1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"tools.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.0"},{"fixed":"3.2.3"}]}],"versions":["3.2.0","3.2.1","3.2.2"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.18.11"}]}],"versions":["2.10.0","2.10.0.pr1","2.10.0.pr2","2.10.0.pr3","2.10.1","2.10.2","2.10.3","2.10.4","2.10.5","2.10.5.1","2.11.0","2.11.0.rc1","2.11.1","2.11.2","2.11.3","2.11.4","2.12.0","2.12.0-rc1","2.12.0-rc2","2.12.1","2.12.2","2.12.3","2.12.4","2.12.5","2.12.6","2.12.6.1","2.12.7","2.12.7.1","2.12.7.2","2.13.0","2.13.0-rc1","2.13.0-rc2","2.13.1","2.13.2","2.13.2.1","2.13.2.2","2.13.3","2.13.4","2.13.4.1","2.13.4.2","2.13.5","2.14.0","2.14.0-rc1","2.14.0-rc2","2.14.0-rc3","2.14.1","2.14.2","2.14.3","2.15.0","2.15.0-rc1"]},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.0"},{"fixed":"2.22.3"}]}],"versions":["2.22.0","2.22.1","2.22.2"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.21.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"version":"3.1.7"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"tools.jackson.core:jackson-databind"},"version":"3.2.3"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.18.11"},{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:37:26Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.fasterxml.jackson.core:jackson-databind"},"version":"2.22.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.21.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"tools.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"version":"3.1.7"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"tools.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/tools.jackson.core/jackson-databind"},"version":"3.2.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.18.11"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","source_modified_at":"2026-09-30T15:46:18.051343022Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"name":"com.fasterxml.jackson.core:jackson-databind","ecosystem":"Maven","purl":"pkg:maven/com.fasterxml.jackson.core/jackson-databind"},"version":"2.22.3"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.0045,"percentile":0.38163,"score_date":"2026-10-23"},"published_at":"2026-09-23T02:21:48.323Z","modified_at":"2026-09-30T15:46:18.051343022Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-09-30T15:37:26Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-91777","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-23T14:05:17.919Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-cxp5-3px4-pw24","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-09-30T15:46:18.051343022Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-91777","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91777","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/FasterXML/jackson-databind/issues/6204","tags":["patch"]},{"url":"https://github.com/FasterXML/jackson-databind/pull/6204","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7","source":"GitHub Advisory Database"},{"url":"https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-cxp5-3px4-pw24","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-23T14:04:51.226591Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T15:46:18.051343022Z","content_hash":"bea7c0eb672da7d2422116060c70986438b31526b01eda279b72123e6dac9eff"}}