CVE-2026-91776

{
  "etk_id": "ETK-2026-17",
  "cve_id": "CVE-2026-91776",
  "display_id": "CVE-2026-91776",
  "ghsa_id": "GHSA-wv8q-qhhj-9h54",
  "euvd_id": "EUVD-2026-85002",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded deserializer cache growth in jackson-databind",
  "summary": "jackson-databind can retain separate deserializer-cache entries for distinct unrecognized type IDs that resolve to the same configured fallback. An attacker able to submit many such IDs may increase process memory use and cause availability pressure when name-based polymorphism with a fallback is enabled and a long-lived mapper is reused.",
  "mitigation": "Upgrade com.fasterxml.jackson.core:jackson-databind to 2.18.11, 2.21.7, or 2.22.3, or tools.jackson.core:jackson-databind to 3.1.7 or 3.2.3. Until upgraded, disable fallback-based name polymorphism for untrusted input or reject unrecognized attacker-controlled type IDs.",
  "vendor": "maven",
  "product": "maven:com.fasterxml.jackson.core:jackson-databind",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, <= 2.18.10"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.18.11"
      ],
      "package_name": "com.fasterxml.jackson.core:jackson-databind",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.19.0, <= 2.21.6"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.21.7"
      ],
      "package_name": "com.fasterxml.jackson.core:jackson-databind",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.22.0, <= 2.22.2"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.22.3"
      ],
      "package_name": "com.fasterxml.jackson.core:jackson-databind",
      "purl": "pkg:maven/com.fasterxml.jackson.core/jackson-databind"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.0.0, <= 3.1.6"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "3.1.7"
      ],
      "package_name": "tools.jackson.core:jackson-databind",
      "purl": "pkg:maven/tools.jackson.core/jackson-databind"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.2.0, <= 3.2.2"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "3.2.3"
      ],
      "package_name": "tools.jackson.core:jackson-databind",
      "purl": "pkg:maven/tools.jackson.core/jackson-databind"
    }
  ],
  "cwes": [
    400
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.0045,
  "epss_percentile": 0.3807,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 16.4412479,
  "t0_at": "2026-09-23T02:17:50.480000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-21T10:35:41.320383+00:00",
      "days": 28.345727319247686,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T02:17:50.480000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-09-23T02:17:50.480000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-23T02:17:50.480000+00:00",
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54"
    }
  }
}