All vulnerabilities
CVE-2026-91777GHSA-cxp5-3px4-pw24

jackson-databind quadratic forward-reference completion

FasterXML com.fasterxml.jackson.core:jackson-databindmavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 23 Sep 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.45%Chance of exploitation activity in the next 30 days, higher than 38% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.21.7Also 3.1.7, 3.2.3 and 2 moreGitHub
Published23 Sep 2026Updated 30 Sep 2026CVE List

What fixes it

  • 2.21.7com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.7</version></dependency>
  • 3.1.7tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.7</version></dependency>
  • 3.2.3tools.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.3</version></dependency>
  • 2.18.11com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.11</version></dependency>
  • 2.22.3com.fasterxml.jackson.core:jackson-databind, mavenGitHub<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.3</version></dependency>
  • 2.21.7com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.21.7</version></dependency>
Show all 10 fixed versions
  • 3.1.7tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.1.7</version></dependency>
  • 3.2.3tools.jackson.core:jackson-databind, MavenOSV<dependency><groupId>tools.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>3.2.3</version></dependency>
  • 2.18.11com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.18.11</version></dependency>
  • 2.22.3com.fasterxml.jackson.core:jackson-databind, MavenOSV<dependency><groupId>com.fasterxml.jackson.core</groupId><artifactId>jackson-databind</artifactId><version>2.22.3</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Summary

When an @JsonIdentityInfo collection or map first creates N unresolved object-ID references and later resolves the same IDs in reverse order, jackson-databind scans the remaining pending-reference accumulator for each resolution. A shallow JSON document whose size grows linearly can therefore cause quadratic CPU work during deserialization.

Details

The affected path is forward-reference completion in CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the corresponding map implementation. The implementation performs a linear search of the pending accumulator for every resolved object ID.

The behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and 3.2.1. Current 2.22 and 3.2 source branches retained the same design when rechecked. A 2.4.0 control fails closed before successful reverse-order completion, so 2.5.0 is the conservative runtime-confirmed affected floor. The patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.

The vulnerable application must deserialize attacker-influenced JSON into an identity-enabled collection or map. The issue does not require deep nesting or syntactically unusual JSON.

Suggested correction: replace repeated linear lookup/removal with a keyed pending-reference structure or another design that provides linear or amortized-linear completion. A regression should preserve input order, duplicate-ID behavior, and unresolved-ID errors while bounding reverse-order resolution work.

PoC

The proof constructs a shallow collection containing N unresolved @JsonIdentityInfo references followed by definitions of those same IDs in reverse order. Its ID class counts equals() calls, giving a deterministic work measure rather than a timing-dependent result.

With N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An equally sized control in which every reference is already resolved performs zero comparisons in the pending-reference lookup path. The run is bounded to a 512 MiB JVM. The result demonstrates quadratic growth: approximately N * (N + 1) / 2 comparisons, plus fixed setup comparisons.

Impact

An unauthenticated source that can submit JSON to an application using the affected identity-enabled collection or map shape can consume quadratic CPU and exhaust a request-time or worker-capacity budget, causing denial of service. The application model/configuration prerequisite is material. No confidentiality, integrity, code-execution, or parser-depth impact is claimed.

Requested credit: Daniel Birtwhistle

Text from GitHub Advisory Database

Affected versions 100

  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.19.0, <= 2.21.6GitHub
  • tools.jackson.core:jackson-databind, maven>= 3.0.0, <= 3.1.6GitHub
  • tools.jackson.core:jackson-databind, maven>= 3.2.0, <= 3.2.2GitHub
  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.5.0, <= 2.18.10GitHub
  • com.fasterxml.jackson.core:jackson-databind, maven>= 2.22.0, <= 2.22.2GitHub
  • jackson-databindaffected: 2.5.0 through 2.18.10CVE List
  • jackson-databindaffected: 2.19.0 through 2.21.6CVE List
  • jackson-databindaffected: 2.22.0 through 2.22.2CVE List
  • jackson-databindaffected: 3.0.0 through 3.1.6CVE List
  • jackson-databindaffected: 3.2.0 through 3.2.2CVE List
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.19.0, fixed in 2.21.7OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.19.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.20.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.21.6OSV
  • tools.jackson.core:jackson-databind, Mavenfrom 3.0.0, fixed in 3.1.7OSV
  • tools.jackson.core:jackson-databind, Maven3.0.0OSV
  • tools.jackson.core:jackson-databind, Maven3.0.1OSV
  • tools.jackson.core:jackson-databind, Maven3.0.2OSV
  • tools.jackson.core:jackson-databind, Maven3.0.3OSV
  • tools.jackson.core:jackson-databind, Maven3.0.4OSV
  • tools.jackson.core:jackson-databind, Maven3.1.0OSV
  • tools.jackson.core:jackson-databind, Maven3.1.0-rc1OSV
  • tools.jackson.core:jackson-databind, Maven3.1.1OSV
  • tools.jackson.core:jackson-databind, Maven3.1.2OSV
  • tools.jackson.core:jackson-databind, Maven3.1.3OSV
  • tools.jackson.core:jackson-databind, Maven3.1.4OSV
  • tools.jackson.core:jackson-databind, Maven3.1.5OSV
  • tools.jackson.core:jackson-databind, Maven3.1.6OSV
  • tools.jackson.core:jackson-databind, Mavenfrom 3.2.0, fixed in 3.2.3OSV
  • tools.jackson.core:jackson-databind, Maven3.2.0OSV
  • tools.jackson.core:jackson-databind, Maven3.2.1OSV
  • tools.jackson.core:jackson-databind, Maven3.2.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.5.0, fixed in 2.18.11OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.0.pr3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.10.5.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.0.rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.11.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.0-rc2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.6OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.6.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.12.7.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.0-rc2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.2.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.4OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.4.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.4.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.13.5OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.14.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.14.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.14.0-rc2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.14.0-rc3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.14.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.14.2OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.14.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.15.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.15.0-rc1OSV
  • com.fasterxml.jackson.core:jackson-databind, Mavenfrom 2.22.0, fixed in 2.22.3OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.22.0OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.22.1OSV
  • com.fasterxml.jackson.core:jackson-databind, Maven2.22.2OSV

References 11