# CVE-2026-91777: jackson-databind quadratic complexity in forward-reference resolution

Source: https://junglewise.ai/threats/cve-2026-91777-jackson-databind-quadratic-forward-reference-completion  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-91777 · Severity: high · CVSS 7.5 · Published 2026-09-30

Jackson-databind, a widely used JSON parsing library, contains a performance flaw in how it resolves forward references within identity-enabled collections. When processing specially crafted JSON with references resolved in reverse order, the library performs an exponential amount of work that grows quadratically with input size, allowing an attacker to exhaust server CPU resources and cause denial of service without needing deep nesting or complex JSON structures.

Technologies: [FasterXML Jackson Databind](https://junglewise.ai/threats/technologies/jackson-databind), [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind), [tools.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/tools-jackson-core-jackson-databind). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-91777 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91777 being exploited in the wild.

**How severe is CVE-2026-91777?** High severity, with a CVSS score of 7.5, published 30 September 2026.

**Which products and versions are affected?** FasterXML Jackson Databind 2.5.0 through 2.18.10, 2.19.0 through 2.21.6, 2.22.0 through 2.22.2, 3.0.0 through 3.1.6, 3.2.0 through 3.2.2; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.19.0,fixed=2.21.7; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.0.0,fixed=3.1.7.

**Is there a fix for CVE-2026-91777?** Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.7 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-91777 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-91777?** Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.21.7 or later

  ```sh
  # set com.fasterxml.jackson.core:jackson-databind to 2.21.7 in your pom.xml or build.gradle
  ```

- tools.jackson.core:jackson-databind (Maven): upgrade to 3.1.7 or later

  ```sh
  # set tools.jackson.core:jackson-databind to 3.1.7 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability exists in CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and its map equivalent, where each forward-reference resolution performs a linear scan of all pending references. When N unresolved @JsonIdentityInfo references are followed by ID resolutions in reverse order, the implementation performs approximately N*(N+1)/2 comparisons, resulting in quadratic complexity. An unauthenticated attacker can trigger this by submitting malicious JSON to any application deserializing identity-enabled collections or maps.

## Affected products

- FasterXML jackson-databind 2.5.0 through 2.18.10, 2.19.0 through 2.21.6, 2.22.0 through 2.22.2, 3.0.0 through 3.1.6, 3.2.0 through 3.2.2

## Identifiers

- CVE-2026-91777
- GHSA-cxp5-3px4-pw24

## Timeline

- 2026-09-30: disclosed: Vulnerability disclosed via GHSA-cxp5-3px4-pw24
- 2026-09-30: patched: Patched in versions 2.18.11, 2.21.7, 2.22.3, 3.1.7, and 3.2.3

## Related threats

- [jackson-databind type validation bypass in generic arguments](https://junglewise.ai/threats/cve-2026-110879-jackson-databind-validates-the-outer-class-of-a-class-name-type)
- [Jackson Protobuf Parser integer overflow in string key parsing](https://junglewise.ai/threats/cve-2026-110747-protobufparser-readstringkey-reads-the-length-prefix-of-a)
- [FasterXML Jackson Databind unbounded cache growth on unknown type IDs](https://junglewise.ai/threats/cve-2026-91776-jackson-databind-retains-every-unknown-raw-type-id)
- [FasterXML jackson-databind quadratic parse in XML datatype deserialization](https://junglewise.ai/threats/cve-2026-68497-fasterxml-jackson-databind-quadratic-parse-in-xml-datatype)
- [FasterXML Jackson Databind unsafe polymorphic type deserialization](https://junglewise.ai/threats/cve-2026-83557-fasterxml-jackson-databind-unsafe-polymorphic-type)