Description
Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.
Published: 2026-09-23
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Immediate Patch
AI Analysis

Impact

A quadratic CPU usage path has been discovered in Jackson‑databind's handling of @JsonIdentityInfo object IDs. When an identity‑enabled collection or map is built from a JSON document that first references N unresolved IDs and later defines those IDs in reverse order, the deserializer performs approximately N*(N+1)/2 identity comparisons. This causes CPU consumption that grows quadratically with document size, leading to a denial of service for an application that accepts attacker‑controlled JSON.

Affected Systems

The vulnerability affects the FasterXML jackson-databind library, specifically versions 2.5.x through 2.17.x, 2.19.x, 2.20.x, and 3.0.x, which have no fix in their own branch and are no longer maintained upstream. The recommended fix is to upgrade to one of the patched releases: 2.18.11, 2.21.7, or 2.22.3, or to the 3.1.7 or 3.2.3 releases from tools.jackson.core.

Risk and Exploitability

The CVSS score of 7.5 indicates a high severity attack. Although the EPSS score is not available and the vulnerability is not listed in KEV, the attack is straightforward to carry out: an application that deserializes attacker‑controlled JSON into an @JsonIdentityInfo‑enabled collection or map can trigger the quadratic CPU path by sending a specially crafted document with unresolved IDs listed first. The prerequisite is only that the application accepts the JSON payload; no deep nesting or exotic syntax is required. The resulting resource exhaustion can degrade or halt the affected service, but no data is disclosed or integrity is compromised.

Generated by OpenCVE AI on September 23, 2026 at 03:21 UTC.

Remediation

Vendor Solution

Upgrade to com.fasterxml.jackson.core:jackson-databind 2.18.11, 2.21.7 or 2.22.3, or to tools.jackson.core:jackson-databind 3.1.7 or 3.2.3. Lines 2.5.x through 2.17.x, 2.19.x, 2.20.x and 3.0.x received no fix on their own branch and are no longer maintained upstream.

Vendor Workaround

Bound the size of JSON documents deserialized into @JsonIdentityInfo-enabled collections and maps, and cap the number of elements accepted for such types, so that the quadratic term cannot be driven large. Removing @JsonIdentityInfo from types reachable from attacker-influenced input avoids the code path entirely. Wall-clock timeouts on deserialization limit the impact of a single request.

OpenCVE Recommended Actions

  • Upgrade FasterXML jackson-databind to a fixed version such as 2.18.11, 2.21.7, 2.22.3, 3.1.7, or 3.2.3.
  • If an upgrade is not immediately possible, limit the size of JSON documents deserialized into @JsonIdentityInfo–enabled types and cap the number of elements accepted for such collections and maps to prevent the quadratic term from becoming large.
  • Remove @JsonIdentityInfo annotations from types that can be reached via attacker‑controlled input to eliminate the vulnerable code path, or enforce wall‑clock timeouts on deserialization to constrain the impact of a single request.

Generated by OpenCVE AI on September 23, 2026 at 03:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-cxp5-3px4-pw24 jackson-databind quadratic forward-reference completion
History

Wed, 23 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 03:45:00 +0000

Type Values Removed Values Added
First Time appeared Fasterxml
Fasterxml jackson-databind
Vendors & Products Fasterxml
Fasterxml jackson-databind

Wed, 23 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
Description Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an identity-enabled collection or map and then defines those same IDs in reverse order, completion performs on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference lookup path for an equally sized control in which every reference was already resolved. The input requires no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear lookup with a keyed pending-reference structure.
Title jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
Weaknesses CWE-400
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Fasterxml Jackson-databind
cve-icon MITRE

Status: PUBLISHED

Assigner: HeroDevs

Published:

Updated: 2026-09-23T14:05:17.919Z

Reserved: 2026-09-15T01:25:58.562Z

Link: CVE-2026-91777

cve-icon Vulnrichment

Updated: 2026-09-23T14:05:05.425Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T03:17:04.783

Modified: 2026-09-24T20:43:32.537

Link: CVE-2026-91777

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T03:30:17Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption