{"uuid": "3d06c11e-3a42-41d8-adba-692e37168a58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-91776", "type": "seen", "source": "https://gist.github.com/alon710/09eddf226ff818caba74308b199b1f70", "content": "# CVE-2026-91776: CVE-2026-91776: Denial of Service via Unbounded Polymorphic Cache in jackson-databind\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91776\n\n## Summary\nCVE-2026-91776 is a high-severity Denial of Service (DoS) vulnerability in the FasterXML jackson-databind library. The vulnerability is caused by uncontrolled resource consumption (CWE-400) where raw, unrecognized polymorphic type IDs are cached indefinitely without boundaries inside TypeDeserializerBase. When name-based polymorphic deserialization is configured with a fallback mechanism (such as a default implementation or custom problem handlers), remote attackers can send crafted payloads containing unique unknown type IDs, causing heap exhaustion, Garbage Collection (GC) overhead limit exhaustion, and an Out-of-Memory (OOM) crash.\n\n## TL;DR\nAn unauthenticated remote attacker can crash Java applications using Jackson-databind by transmitting JSON payloads with high-cardinality, unrecognized polymorphic type IDs, causing unbounded memory retention and JVM heap exhaustion.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS Severity**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept Available\n- **KEV Status**: Not Listed\n- **Vulnerability Class**: Uncontrolled Resource Consumption\n\n## Affected Systems\n\n- FasterXML jackson-databind versions 2.0.0 through 2.18.10\n- FasterXML jackson-databind versions 2.19.0 through 2.21.6\n- FasterXML jackson-databind versions 2.22.0 through 2.22.2\n- FasterXML jackson-databind versions 3.0.0 through 3.1.6\n- FasterXML jackson-databind versions 3.2.0 through 3.2.2\n- **jackson-databind**: >= 2.0.0, <= 2.18.10 (Fixed in: `2.18.11`)\n- **jackson-databind**: >= 2.19.0, <= 2.21.6 (Fixed in: `2.21.7`)\n- **jackson-databind**: >= 2.22.0, <= 2.22.2 (Fixed in: `2.22.3`)\n- **jackson-databind**: >= 3.0.0, <= 3.1.6 (Fixed in: `3.1.7`)\n- **jackson-databind**: >= 3.2.0, <= 3.2.2 (Fixed in: `3.2.3`)\n\n## Mitigation\n\n- Upgrade the jackson-databind library to a patched version immediately.\n- Refactor polymorphic type definitions to remove defaultImpl fallback configurations where possible.\n- Implement a custom TypeIdResolver that strictly validates type IDs against an allowlist before resolution.\n- Deploy WAF rules to drop payloads containing abnormally long polymorphic type identifiers.\n\n**Remediation Steps:**\n1. Analyze dependency structures (using Maven or Gradle) to identify references to vulnerable jackson-databind versions.\n2. Update Maven pom.xml or Gradle build.gradle files to specify a patched version (e.g., 2.18.11, 2.21.7, 2.22.3, 3.1.7, or 3.2.3).\n3. Run integration tests to confirm compatibility with the updated library, paying special attention to polymorphic deserialization tests.\n4. Deploy the updated build artifacts to staging and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-wv8q-qhhj-9h54](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54)\n- [FasterXML Jackson Databind Issue #6203](https://github.com/FasterXML/jackson-databind/issues/6203)\n- [Fix Commit 2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577](https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577)\n- [Wiz Vulnerability Database Entry for CVE-2026-91776](https://www.wiz.io/vulnerability-database/cve/cve-2026-91776)\n- [CVE-2026-91776 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-91776)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91776) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T21:30:31.000000Z"}