Read the docs
TI-2026-61988 Aliases CVE-2026-91777GHSA-cxp5-3px4-pw24

jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 22 fixed, 13 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00487 42nd percentileScored 2026-11-08
Fix Partial com.fasterxml.jackson.core:jackson-databind (Maven): 2.21.7, 2.18.11, 2.22.3tools.jackson.core:jackson-databind (Maven): 3.1.7, 3.2.3Red Hat: 22 advisoriesRed Hat: 22 fixed, 13 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-databind2.5.0 – 2.18.10; 2.19.0 – 2.21.6; 2.22.0 – 2.22.2—No fix listedCNA
FasterXMLjackson-databind3.0.0 – 3.1.6; 3.2.0 – 3.2.2—No fix listedCNA
—com.fasterxml.jackson.core:jackson-databind (Maven)2.19.0 to before 2.21.72.21.7Patch availableGHSA-cxp5-3px4-pw24
—tools.jackson.core:jackson-databind (Maven)3.0.0 to before 3.1.73.1.7Patch availableGHSA-cxp5-3px4-pw24
—tools.jackson.core:jackson-databind (Maven)3.2.0 to before 3.2.33.2.3Patch availableGHSA-cxp5-3px4-pw24
—com.fasterxml.jackson.core:jackson-databind (Maven)2.5.0 to before 2.18.112.18.11Patch availableGHSA-cxp5-3px4-pw24
—com.fasterxml.jackson.core:jackson-databind (Maven)2.22.0 to before 2.22.32.22.3Patch availableGHSA-cxp5-3px4-pw24
  • jackson-databind VendorFasterXML Affected 2.5.0 – 2.18.10; 2.19.0 – 2.21.6; 2.22.0 – 2.22.2 Fixed in — No fix listed CNA
  • jackson-databind VendorFasterXML Affected 3.0.0 – 3.1.6; 3.2.0 – 3.2.2 Fixed in — No fix listed CNA
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.19.0 to before 2.21.7 Fixed in 2.21.7 Patch available GHSA-cxp5-3px4-pw24
  • tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.0.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-cxp5-3px4-pw24
  • tools.jackson.core:jackson-databind (Maven) Vendor— Affected 3.2.0 to before 3.2.3 Fixed in 3.2.3 Patch available GHSA-cxp5-3px4-pw24
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.5.0 to before 2.18.11 Fixed in 2.18.11 Patch available GHSA-cxp5-3px4-pw24
  • com.fasterxml.jackson.core:jackson-databind (Maven) Vendor— Affected 2.22.0 to before 2.22.3 Fixed in 2.22.3 Patch available GHSA-cxp5-3px4-pw24

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:*——FasterXML
  • cpe:2.3:a:fasterxml:jackson-databind:*:*:*:*:*:*:*:* Versions — — ·FasterXML

Remediation

  • Fix · GHSA-cxp5-3px4-pw24 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.21.7 Advisory →
  • Fix · GHSA-cxp5-3px4-pw24 tools.jackson.core:jackson-databind (Maven) Fixed in 3.1.7 Advisory →
  • Fix · GHSA-cxp5-3px4-pw24 tools.jackson.core:jackson-databind (Maven) Fixed in 3.2.3 Advisory →
  • Fix · GHSA-cxp5-3px4-pw24 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.18.11 Advisory →
  • Fix · GHSA-cxp5-3px4-pw24 com.fasterxml.jackson.core:jackson-databind (Maven) Fixed in 2.22.3 Advisory →

Red Hat 22 advisories

  • RHSA-2026:95762 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Images Security Update
    • Red Hat build of Keycloak 26.6 rhbk/keycloak-operator-bundle, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator
  • RHSA-2026:95761 Released 2026-11-06 · Red Hat rating Important
    Red Hat build of Keycloak 26.6.8 Security Update
    • Red Hat build of Keycloak 26.6.8
  • RHSA-2026:93444 Released 2026-11-02 · Red Hat rating Important
    jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) jackson-annotations-2.21-1.el9_4.1, jackson-core-2.21.6-1.el9_4, jackson-databind-2.21.6-1.el9_4.1 +8
Show 19 more Red Hat advisories
  • RHSA-2026:90909 Released 2026-10-27 · Red Hat rating Important
    pki-deps:10.6 security update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.10.0+20993+d0f024b0.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.10.0+20993+d0f024b0.noarch::pki-deps:10.6 +47
  • RHSA-2026:89924 Released 2026-10-26 · Red Hat rating Important
    jackson-databind security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) jackson-databind-2.21.6-1.el9_2.1, pki-jackson-databind-2.21.6-1.el9_2.1
  • RHSA-2026:89734 Released 2026-10-26 · Red Hat rating Important
    jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) jackson-core-2.21.6-1.el9_6, jackson-databind-2.21.6-1.el9_6.1, jackson-jaxrs-providers-2.21.6-1.el9_6 +6
  • RHSA-2026:88159 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88158 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88157 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88156 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88155 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88154 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88153 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:88151 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88152 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88149 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:88150 Released 2026-10-22 · Red Hat rating Critical
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:85231 Released 2026-10-19 · Red Hat rating Important
    jackson-databind security update
    • Red Hat Enterprise Linux AppStream (v. 9) jackson-databind-2.21.6-1.el9_8.1, pki-jackson-databind-2.21.6-1.el9_8.1
  • RHSA-2026:83670 Released 2026-10-15 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.GA)
    • Red Hat Build of Apache Camel 3.33.4.redhat com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar, io.micrometer.micrometer-core-1.16.7.redhat-00002.jar +14
  • RHSA-2026:83520 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.33.4 release and security update
    • Red Hat build of Quarkus 3.33.4.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +10
  • RHSA-2026:83082 Released 2026-10-15 · Red Hat rating Important
    Red Hat build of Quarkus 3.27.6 release and security update
    • Red Hat build of Quarkus 3.27.6.redhat at.yawk.lz4.lz4-java-1.11.1.rhel8-redhat-00001.jar, com.fasterxml.jackson.core.jackson-core-2.21.7.redhat-00001.jar, com.fasterxml.jackson.core.jackson-databind-2.21.7.redhat-00001.jar +11

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 8AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat build of Apicurio Registry 3AffectedNo fix yet
Red Hat build of Debezium 3AffectedNo fix yet
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:88152
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:88149
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:88151
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:88150
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:88156
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:88159
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:88153
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:88158
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:88157
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:88155
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:88154
Red Hat Build of Apache Camel 3.33.4.redhatFixed RHSA-2026:83670
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:90909
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:85231
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:89924
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:93444
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:89734
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat build of Keycloak 26.6Fixed RHSA-2026:95762
Red Hat build of Keycloak 26.6.8Fixed RHSA-2026:95761
Red Hat build of Quarkus 3.27.6.redhatFixed RHSA-2026:83082
Red Hat build of Quarkus 3.33.4.redhatFixed RHSA-2026:83520
Not affected: 39 products
  • Exploit Intelligence
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • OpenShift Serverless
  • Red Hat AI Inference Server
  • Red Hat AMQ Broker 7
  • Red Hat Ansible Automation Platform 2
  • Red Hat Build of Apache Camel 3.33.4.redhat
  • Red Hat Build of Keycloak
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 9
  • Red Hat Certificate System 10
  • Red Hat Certificate System 11
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Fuse 7
  • Red Hat Hardened Images
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 7
  • Red Hat Lightspeed for Runtimes Operator
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift Dev Spaces
  • Red Hat Satellite 6
  • Red Hat build of Quarkus 3.27.6.redhat
  • Red Hat build of Quarkus 3.33.4.redhat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-91777
  2. 2026-10-03 Alias added: GHSA-cxp5-3px4-pw24
  3. 2026-10-05 Affected versions changed · Red Hat
  4. 2026-10-06 Affected versions changed · Red Hat
  5. 2026-10-09 Affected versions changed · Red Hat
  6. 2026-10-16 Fix available: RHSA-2026:83520 · Red Hat
  7. 2026-10-16 Fix available: RHSA-2026:83082 · Red Hat
  8. 2026-10-16 Fix available: Red Hat build of Quarkus 3.27.6.redhat, Red Hat build of Quarkus 3.33.4.redhat · Red Hat
  9. 2026-10-20 Fix available: RHSA-2026:85231 · Red Hat
  10. 2026-10-20 Fix available: Red Hat Enterprise Linux AppStream (v. 9) · Red Hat
  11. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  12. 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
  13. 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
  14. 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
  15. 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
  16. 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
  17. 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
  18. 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
  19. 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
  20. 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
  21. 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
  22. 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
  23. 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +9 · Red Hat
  24. 2026-10-26 Fix available: RHSA-2026:89734 · Red Hat
  25. 2026-10-26 Fix available: Red Hat Enterprise Linux AppStream EUS (v.9.6) · Red Hat
  26. 2026-10-26 Fix available: RHSA-2026:89924 · Red Hat
  27. 2026-10-26 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.2) · Red Hat
  28. 2026-10-29 Fix available: Red Hat Enterprise Linux AppStream (v. 8) · Red Hat
  29. 2026-10-29 Fix available: RHSA-2026:90909 · Red Hat
  30. 2026-11-02 Fix available: RHSA-2026:93444 · Red Hat
  31. 2026-11-02 Fix available: Red Hat Enterprise Linux AppStream E4S (v.9.4) · Red Hat
  32. 2026-11-06 Fix available: Red Hat Build of Apache Camel 3.33.4.redhat · Red Hat
  33. 2026-11-06 Fix available: RHSA-2026:83670 · Red Hat
  34. 2026-11-06 Fix available: RHSA-2026:95761 · Red Hat
  35. 2026-11-06 Fix available: Red Hat build of Keycloak 26.6.8 · Red Hat
  36. 2026-11-06 Fix available: RHSA-2026:95762 · Red Hat
  37. 2026-11-06 Fix available: Red Hat build of Keycloak 26.6 · Red Hat

References

Patch 1

Advisory 2

Other 8

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
  • TI-2026-60468 jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences