CVE-2026-91776: FasterXML Jackson Databind unbounded cache growth on unknown type IDs

CVE-2026-91776 · Severity: high · CVSS 7.5 · Published 2026-09-30

Jackson Databind is a Java library that deserializes JSON into objects, including support for polymorphic types. When configured with name-based type polymorphism and a fallback implementation, the library caches deserializers keyed by attacker-supplied type IDs without bounds. An attacker supplying many distinct unknown type names can cause unbounded memory growth in long-lived application processes, leading to denial of service.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-91776 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-91776 being exploited in the wild.
How severe is CVE-2026-91776?
High severity, with a CVSS score of 7.5, published 30 September 2026.
Which products and versions are affected?
FasterXML Jackson Databind Before 2.18.11, 2.21.x before 2.21.7, 2.22.x before 2.22.3, 3.1.x before 3.1.7, 3.2.x before 3.2.3; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.0.0,fixed=2.18.11; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.7.
Is there a fix for CVE-2026-91776?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.11 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91776 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-91776?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.11 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.18.11 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.7 or later
    # set tools.jackson.core:jackson-databind to 3.1.7 in your pom.xml or build.gradle

Technical details

The vulnerability exists in TypeDeserializerBase._findDeserializer() where unknown name-based type IDs are cached in an unbounded _deserializers map using the raw attacker-supplied type ID as the cache key, even though all unknown IDs resolve to the same fallback deserializer. An attacker with the ability to provide JSON inputs containing arbitrarily many distinct unknown polymorphic type names to a long-lived mapper can exhaust heap memory through incremental cache retention.

Affected products

  • FasterXML Jackson Databind Before 2.18.11, 2.21.x before 2.21.7, 2.22.x before 2.22.3, 3.1.x before 3.1.7, 3.2.x before 3.2.3

Identifiers

  • CVE-2026-91776
  • GHSA-wv8q-qhhj-9h54

Timeline

  • 2026-09-30: disclosed
  • 2026-09-30: patched: Patched in versions 2.18.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.