CVE-2026-91777: jackson-databind quadratic complexity in forward-reference resolution

CVE-2026-91777 · Severity: high · CVSS 7.5 · Published 2026-09-30

Jackson-databind, a widely used JSON parsing library, contains a performance flaw in how it resolves forward references within identity-enabled collections. When processing specially crafted JSON with references resolved in reverse order, the library performs an exponential amount of work that grows quadratically with input size, allowing an attacker to exhaust server CPU resources and cause denial of service without needing deep nesting or complex JSON structures.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-91777 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-91777 being exploited in the wild.
How severe is CVE-2026-91777?
High severity, with a CVSS score of 7.5, published 30 September 2026.
Which products and versions are affected?
FasterXML Jackson Databind 2.5.0 through 2.18.10, 2.19.0 through 2.21.6, 2.22.0 through 2.22.2, 3.0.0 through 3.1.6, 3.2.0 through 3.2.2; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.19.0,fixed=2.21.7; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.7.
Is there a fix for CVE-2026-91777?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.7 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-91777 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-91777?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.7 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.21.7 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.7 or later
    # set tools.jackson.core:jackson-databind to 3.1.7 in your pom.xml or build.gradle

Technical details

The vulnerability exists in CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and its map equivalent, where each forward-reference resolution performs a linear scan of all pending references. When N unresolved @JsonIdentityInfo references are followed by ID resolutions in reverse order, the implementation performs approximately N*(N+1)/2 comparisons, resulting in quadratic complexity. An unauthenticated attacker can trigger this by submitting malicious JSON to any application deserializing identity-enabled collections or maps.

Affected products

  • FasterXML jackson-databind 2.5.0 through 2.18.10, 2.19.0 through 2.21.6, 2.22.0 through 2.22.2, 3.0.0 through 3.1.6, 3.2.0 through 3.2.2

Identifiers

  • CVE-2026-91777
  • GHSA-cxp5-3px4-pw24

Timeline

  • 2026-09-30: disclosed: Vulnerability disclosed via GHSA-cxp5-3px4-pw24
  • 2026-09-30: patched: Patched in versions 2.18.11, 2.21.7, 2.22.3, 3.1.7, and 3.2.3

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.