Description
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
Published: 2026-09-23
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service (Memory Exhaustion)
Action: Apply Patch
AI Analysis

Impact

The vulnerability arises from the TypeDeserializerBase caching system that stores every unrecognized type ID as a separate key while using a fallback deserializer. By repeatedly providing new unknown type IDs, an attacker can cause the cache to grow unboundedly and retain memory for each entry. This monotonic growth can exhaust application memory and lead to service interruption. The weakness aligns with CWE-400, which denotes uncontrolled resource consumption.

Affected Systems

Applications built with FasterXML jackson-databind versions 2.0.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x are affected, as these branches did not receive a fix and are no longer maintained. The issue is fixed in jackson-databind 2.18.11, 2.21.7 or 2.22.3, and in tools.jackson.core:jackson-databind 3.1.7 or 3.2.3. The vulnerability manifests only when name‑based polymorphic deserialization is enabled with a defaultImpl or similar fallback and the ObjectMapper instance is reused across requests.

Risk and Exploitability

The CVSS v3 base score of 7.5 classifies this as a high‑severity DoS flaw. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an application that accepts attacker‑controlled type IDs, has name‑based polymorphism with a fallback, and reuses a long‑lived ObjectMapper, making impact contextual but realistic in commonly used frameworks such as Spring Boot. The fix limits the cache size and rejects unrecognized IDs, mitigating the resource exhaustion vector.

Generated by OpenCVE AI on September 23, 2026 at 03:21 UTC.

Remediation

Vendor Solution

Upgrade to com.fasterxml.jackson.core:jackson-databind 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-databind 3.1.7 or 3.2.3. Lines 2.0.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x received no fix on their own branch and are no longer maintained upstream.

Vendor Workaround

Where the polymorphic shape allows it, avoid defaultImpl or another catch-all fallback for name-based type resolution so that unrecognized type IDs fail rather than resolving, or restrict accepted type IDs with a custom TypeIdResolver that rejects unknown names before resolution. Shortening ObjectMapper or type deserializer lifetime limits accumulation but does not eliminate it.

OpenCVE Recommended Actions

  • Upgrade your jackson-databind library to or beyond com.fasterxml.jackson.core:jackson-databind 2.18.11, 2.21.7 or 2.22.3, or tools.jackson.core:jackson-databind 3.1.7 or 3.2.3 and ensure no older branches remain in the classpath.
  • If upgrading is not immediately possible, configure your JSON deserialization to avoid a defaultImpl fallback—use @JsonTypeInfo without a fallback or supply a custom TypeIdResolver that rejects unknown names before resolution.
  • Consider limiting the lifetime of your ObjectMapper instance or resetting its internal cache between requests to prevent long‑term growth of the deserializer cache.
  • Implement application‑level memory monitoring and enforce limits so that excessive memory usage due to the cache growth can be detected and handled gracefully.

Generated by OpenCVE AI on September 23, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-wv8q-qhhj-9h54 jackson-databind retains every unknown raw type ID
History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Fasterxml
Fasterxml jackson-databind
Vendors & Products Fasterxml
Fasterxml jackson-databind

Wed, 23 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
Title jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Fasterxml Jackson-databind
cve-icon MITRE

Status: PUBLISHED

Assigner: HeroDevs

Published:

Updated: 2026-09-23T14:03:16.129Z

Reserved: 2026-09-15T01:22:24.203Z

Link: CVE-2026-91776

cve-icon Vulnrichment

Updated: 2026-09-23T14:03:00.673Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T03:17:04.620

Modified: 2026-09-24T20:43:32.537

Link: CVE-2026-91776

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T03:30:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption