CVE-2026-91776: jackson-databind retains every unknown raw type ID
With @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unknown
raw type ID selects the same fallback deserializer but is retained as a
separate key in TypeDeserializerBase._deserializers. An attacker who can
repeatedly supply new unknown type IDs can grow this process-lifetime cache
without a configured bound.
References
- github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577
- github.com/FasterXML/jackson-databind/issues/6203
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3
- github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54
- github.com/advisories/GHSA-wv8q-qhhj-9h54
- nvd.nist.gov/vuln/detail/CVE-2026-91776
Code Behaviors & Features
Detect and mitigate CVE-2026-91776 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →