CVE-2026-91777: jackson-databind quadratic forward-reference completion
When an @JsonIdentityInfo collection or map first creates N unresolved
object-ID references and later resolves the same IDs in reverse order,
jackson-databind scans the remaining pending-reference accumulator for each
resolution. A shallow JSON document whose size grows linearly can therefore
cause quadratic CPU work during deserialization.
References
- github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67
- github.com/FasterXML/jackson-databind/issues/6204
- github.com/FasterXML/jackson-databind/pull/6204
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7
- github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3
- github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24
- github.com/advisories/GHSA-cxp5-3px4-pw24
- nvd.nist.gov/vuln/detail/CVE-2026-91777
Code Behaviors & Features
Detect and mitigate CVE-2026-91777 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →