All vulnerabilities
CVE-2026-91776GHSA-wv8q-qhhj-9h54

jackson-databind retains every unknown raw type ID

FasterXML com.fasterxml.jackson.core:jackson-databindmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 23 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.18.11Also 2.21.7, 2.22.3 and 2 moreGitHub
Published23 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

  • 2.18.11com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.11</version></dependency>
  • 2.21.7com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.7</version></dependency>
  • 2.22.3com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.3</version></dependency>
  • 3.1.7tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.7</version></dependency>
  • 3.2.3tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.3</version></dependency>
  • 2.18.11com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.11</version></dependency>
Show all 10 fixed versions
  • 2.21.7com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.7</version></dependency>
  • 2.22.3com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.3</version></dependency>
  • 3.1.7tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.7</version></dependency>
  • 3.2.3tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.3</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

With @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unknown raw type ID selects the same fallback deserializer but is retained as a separate key in TypeDeserializerBase._deserializers. An attacker who can repeatedly supply new unknown type IDs can grow this process-lifetime cache without a configured bound.

Details

The affected path is TypeDeserializerBase._findDeserializer(). After an unknown name-based type ID resolves to the configured fallback/default implementation, jackson-databind caches the result under the attacker-provided raw typeId. Although all such IDs select the same fallback deserializer, each new string remains a distinct cache key.

The behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1. Current 2.22 and 3.2 source branches retained the unbounded _deserializers map and per-raw-ID cache write when rechecked. The earlier affected floor has not been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.

The vulnerable application must enable name-based polymorphism with a defaultImpl or equivalent fallback, accept attacker-influenced type IDs, and reuse a long-lived mapper/type deserializer across requests.

Suggested correction: avoid caching each unknown raw ID when every such ID resolves to the same fallback, use a fallback sentinel, or use an explicitly bounded concurrency-safe cache. A regression should contrast many distinct unknown IDs with repetitions of one unknown ID across requests.

PoC

Configure a polymorphic base type with @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class) and deserialize inputs containing unknown type names through the same mapper. Inspect TypeDeserializerBase._deserializers after the run.

On affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce 10,000 retained cache entries even though every input selects the same fallback deserializer. A matched control that repeats one unknown ID 10,000 times produces one retained entry. This isolates attacker-controlled key cardinality from ordinary request count.

Impact

Where the stated polymorphic fallback configuration is exposed to attacker-influenced type IDs, distinct inputs cause incremental process-lifetime memory retention and eventual availability pressure or denial of service. This is not claimed as a single-request allocation spike, and no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No confidentiality, integrity, or code-execution impact is claimed.

Requested credit: Daniel Birtwhistle

Text from GitHub Advisory Database

Affected versions 100

  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.0.0, <= 2.18.10GitHub
  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.19.0, <= 2.21.6GitHub
  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.22.0, <= 2.22.2GitHub
  • tools.jackson.core:jackson-databind, maven>= 3.0.0, <= 3.1.6GitHub
  • tools.jackson.core:jackson-databind, maven>= 3.2.0, <= 3.2.2GitHub
  • jackson-databindaffected: 2.0.0 through 2.18.10CVE List
  • jackson-databindaffected: 2.19.0 through 2.21.6CVE List
  • jackson-databindaffected: 2.22.0 through 2.22.2CVE List
  • jackson-databindaffected: 3.0.0 through 3.1.6CVE List
  • jackson-databindaffected: 3.2.0 through 3.2.2CVE List
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.0.0, fixed in 2.18.11OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.0.6OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.1.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.5.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.0.rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.6OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.6.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.19.0, fixed in 2.21.7OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.6OSV
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.22.0, fixed in 2.22.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.22.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.22.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.22.2OSV
  • tools.jackson.core:jackson-databind, Mavenfrom 3.0.0, fixed in 3.1.7OSV
  • tools.jackson.core:jackson-databind, Maven3.0.0OSV
  • tools.jackson.core:jackson-databind, Maven3.0.1OSV
  • tools.jackson.core:jackson-databind, Maven3.0.2OSV
  • tools.jackson.core:jackson-databind, Maven3.0.3OSV
  • tools.jackson.core:jackson-databind, Maven3.0.4OSV
  • tools.jackson.core:jackson-databind, Maven3.1.0OSV
  • tools.jackson.core:jackson-databind, Maven3.1.0-rc1OSV
  • tools.jackson.core:jackson-databind, Maven3.1.1OSV
  • tools.jackson.core:jackson-databind, Maven3.1.2OSV
  • tools.jackson.core:jackson-databind, Maven3.1.3OSV
  • tools.jackson.core:jackson-databind, Maven3.1.4OSV
  • tools.jackson.core:jackson-databind, Maven3.1.5OSV
  • tools.jackson.core:jackson-databind, Maven3.1.6OSV
  • tools.jackson.core:jackson-databind, Mavenfrom 3.2.0, fixed in 3.2.3OSV
  • tools.jackson.core:jackson-databind, Maven3.2.0OSV
  • tools.jackson.core:jackson-databind, Maven3.2.1OSV
  • tools.jackson.core:jackson-databind, Maven3.2.2OSV

References 10