CVE-2026-91776
ADVISORY - githubSummary
Summary
With @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unknown
raw type ID selects the same fallback deserializer but is retained as a
separate key in TypeDeserializerBase._deserializers. An attacker who can
repeatedly supply new unknown type IDs can grow this process-lifetime cache
without a configured bound.
Details
The affected path is TypeDeserializerBase._findDeserializer(). After an
unknown name-based type ID resolves to the configured fallback/default
implementation, jackson-databind caches the result under the attacker-provided
raw typeId. Although all such IDs select the same fallback deserializer, each
new string remains a distinct cache key.
The behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.
Current 2.22 and 3.2 source branches retained the unbounded _deserializers
map and per-raw-ID cache write when rechecked. The earlier affected floor has
not been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.
The vulnerable application must enable name-based polymorphism with a
defaultImpl or equivalent fallback, accept attacker-influenced type IDs, and
reuse a long-lived mapper/type deserializer across requests.
Suggested correction: avoid caching each unknown raw ID when every such ID resolves to the same fallback, use a fallback sentinel, or use an explicitly bounded concurrency-safe cache. A regression should contrast many distinct unknown IDs with repetitions of one unknown ID across requests.
PoC
Configure a polymorphic base type with
@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class) and
deserialize inputs containing unknown type names through the same mapper.
Inspect TypeDeserializerBase._deserializers after the run.
On affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce 10,000 retained cache entries even though every input selects the same fallback deserializer. A matched control that repeats one unknown ID 10,000 times produces one retained entry. This isolates attacker-controlled key cardinality from ordinary request count.
Impact
Where the stated polymorphic fallback configuration is exposed to attacker-influenced type IDs, distinct inputs cause incremental process-lifetime memory retention and eventual availability pressure or denial of service. This is not claimed as a single-request allocation spike, and no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No confidentiality, integrity, or code-execution impact is claimed.
Requested credit: Daniel Birtwhistle
Common Weakness Enumeration (CWE)
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption
NIST
3.9
CVSS SCORE
7.5highGitHub
3.9
CVSS SCORE
7.5highDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumChainguard
CGA-5fj8-cwrq-cq66
-
minimos
MINI-233x-98gj-q26p
-
minimos
MINI-298q-2vw2-gw4r
-
minimos
MINI-29vj-ff44-g874
-
minimos
MINI-2hjq-qmm3-vh65
-
minimos
MINI-2mpq-4qwr-qv95
-
minimos
MINI-2r5g-cxwc-xr37
-
minimos
MINI-2rj5-464h-73v8
-
minimos
MINI-3564-qp4r-j679
-
minimos
MINI-35r5-5rq9-9hqg
-
minimos
MINI-3j4c-wf8x-xhmp
-
minimos
MINI-3x6p-4885-vggj
-
minimos
MINI-46m3-4328-v57h
-
minimos
MINI-48r8-xq2q-w893
-
minimos
MINI-49xp-jwr2-jh95
-
minimos
MINI-4h85-99m2-74p5
-
minimos
MINI-4x82-83c8-5fww
-
minimos
MINI-529g-6mpm-3hh7
-
minimos
MINI-53x8-5rc4-9xwg
-
minimos
MINI-596p-qmr7-8vg7
-
minimos
MINI-59h8-cq2j-gjhg
-
minimos
MINI-5q3q-x7jj-hjr7
-
minimos
MINI-6832-8mq3-639w
-
minimos
MINI-6wm6-qw8g-55rh
-
minimos
MINI-73f4-9553-pfwj
-
minimos
MINI-7f2m-gxqf-g856
-
minimos
MINI-7hx3-9x5c-w4cj
-
minimos
MINI-7vwp-vvxq-4jvw
-
minimos
MINI-854v-7gqv-58jr
-
minimos
MINI-86p6-9743-p65p
-
minimos
MINI-8ccm-x2g7-vqp9
-
minimos
MINI-8f3p-qp5x-v3m8
-
minimos
MINI-8h2h-6xmh-7mmp
-
minimos
MINI-8qm9-m7wg-8449
-
minimos
MINI-8vv4-fqfp-5465
-
minimos
MINI-9wfp-r3j7-72hc
-
minimos
MINI-chpq-7h9r-mjjm
-
minimos
MINI-cm97-w8hg-7qhg
-
minimos
MINI-cwjp-q49p-vw4f
-
minimos
MINI-f3f9-v97w-fv75
-
minimos
MINI-f3wm-cfhv-crxp
-
minimos
MINI-f976-66cp-63wx
-
minimos
MINI-fhrm-3c5q-jpjh
-
minimos
MINI-g7g6-99c4-p66w
-
minimos
MINI-g7xr-wvgh-rw63
-
minimos
MINI-h2p4-r9vw-54q9
-
minimos
MINI-h634-83x6-g5hg
-
minimos
MINI-hff5-p74q-pr8r
-
minimos
MINI-hfgc-gcrj-f582
-
minimos
MINI-hqcx-j6c2-gjfq
-
minimos
MINI-hv2f-f352-vvxx
-
minimos
MINI-j6jx-h3w4-m395
-
minimos
MINI-jf68-9cm8-3gvj
-
minimos
MINI-jmjv-jv2f-jqc7
-
minimos
MINI-m4vh-97hg-xw9q
-
minimos
MINI-p2jw-89wp-3j2j
-
minimos
MINI-pf48-hh8q-wf5h
-
minimos
MINI-pg55-298q-xwjg
-
minimos
MINI-q553-hvqf-q99g
-
minimos
MINI-q8pp-wpcr-xq6q
-
minimos
MINI-qcj5-25mw-wqxh
-
minimos
MINI-qhcw-3mq8-f9qf
-
minimos
MINI-r25c-8r49-36f6
-
minimos
MINI-r72f-cc2c-9jxr
-
minimos
MINI-rfh4-3qcc-f76x
-
minimos
MINI-rfv3-754j-mg6g
-
minimos
MINI-rp79-rh89-mm9m
-
minimos
MINI-rp8m-h7mp-f6x5
-
minimos
MINI-rpxp-87h3-fwq4
-
minimos
MINI-rwwm-2qm4-cjj8
-
minimos
MINI-vcq2-wg28-8xpm
-
minimos
MINI-vhqm-2jjp-jhhq
-
minimos
MINI-w2vx-cx48-j7mh
-
minimos
MINI-w44p-wprv-8673
-
minimos
MINI-w583-8q3g-xrp7
-
minimos
MINI-w7rf-9hmp-6f56
-
minimos
MINI-w7rp-q9x9-9cw7
-
minimos
MINI-wg76-f74p-mfff
-
minimos
MINI-x32r-7qwr-6v3x
-
minimos
MINI-x66f-p6q6-qr9j
-
minimos
MINI-x896-345x-7mqr
-
minimos
MINI-xc8m-2crg-rp4r
-
minimos
MINI-xgq3-qc26-gq3m
-
minimos
MINI-xjhp-gf5h-c54v
-
minimos
MINI-xm2m-j985-rff8
-
minimos
MINI-xq37-f9g6-3q52
-