CVE-2026-91777
ADVISORY - githubSummary
Summary
When an @JsonIdentityInfo collection or map first creates N unresolved
object-ID references and later resolves the same IDs in reverse order,
jackson-databind scans the remaining pending-reference accumulator for each
resolution. A shallow JSON document whose size grows linearly can therefore
cause quadratic CPU work during deserialization.
Details
The affected path is forward-reference completion in
CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()
and the corresponding map implementation. The implementation performs a
linear search of the pending accumulator for every resolved object ID.
The behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and 3.2.1. Current 2.22 and 3.2 source branches retained the same design when rechecked. A 2.4.0 control fails closed before successful reverse-order completion, so 2.5.0 is the conservative runtime-confirmed affected floor. The patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.
The vulnerable application must deserialize attacker-influenced JSON into an identity-enabled collection or map. The issue does not require deep nesting or syntactically unusual JSON.
Suggested correction: replace repeated linear lookup/removal with a keyed pending-reference structure or another design that provides linear or amortized-linear completion. A regression should preserve input order, duplicate-ID behavior, and unresolved-ID errors while bounding reverse-order resolution work.
PoC
The proof constructs a shallow collection containing N unresolved
@JsonIdentityInfo references followed by definitions of those same IDs in
reverse order. Its ID class counts equals() calls, giving a deterministic
work measure rather than a timing-dependent result.
With N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An
equally sized control in which every reference is already resolved performs
zero comparisons in the pending-reference lookup path. The run is bounded to
a 512 MiB JVM. The result demonstrates quadratic growth: approximately
N * (N + 1) / 2 comparisons, plus fixed setup comparisons.
Impact
An unauthenticated source that can submit JSON to an application using the affected identity-enabled collection or map shape can consume quadratic CPU and exhaust a request-time or worker-capacity budget, causing denial of service. The application model/configuration prerequisite is material. No confidentiality, integrity, code-execution, or parser-depth impact is claimed.
Requested credit: Daniel Birtwhistle
Common Weakness Enumeration (CWE)
Uncontrolled Resource Consumption
Uncontrolled Resource Consumption
NIST
3.9
CVSS SCORE
7.5highGitHub
3.9
CVSS SCORE
7.5highDebian
-
Ubuntu
-
CVSS SCORE
N/AmediumAlma
-
CVSS SCORE
N/AhighRocky
-
CVSS SCORE
N/AhighOracle
-
CVSS SCORE
N/AhighChainguard
CGA-56wq-p9p8-9c82
-
minimos
MINI-22f8-45j9-5r3w
-
minimos
MINI-22xq-wpxc-rrr4
-
minimos
MINI-24jc-23gw-v39x
-
minimos
MINI-24qv-x6p3-xrw6
-
minimos
MINI-24wq-ccfj-6mvc
-
minimos
MINI-2f2p-9vg3-jjvh
-
minimos
MINI-2v79-9hw2-2c2f
-
minimos
MINI-2vjp-2437-cwg2
-
minimos
MINI-2wq3-q7cq-rmm3
-
minimos
MINI-322q-x79g-849h
-
minimos
MINI-34vx-p747-j5q3
-
minimos
MINI-35cc-c286-ch56
-
minimos
MINI-36f5-m8ff-3w45
-
minimos
MINI-3gv8-qhp8-xmm9
-
minimos
MINI-3pg8-6hh3-hfp8
-
minimos
MINI-3qhc-jfx7-x8vv
-
minimos
MINI-485c-wx6h-qmpw
-
minimos
MINI-4mfj-rpgj-8w7f
-
minimos
MINI-4pgh-q288-vjw6
-
minimos
MINI-52g6-656f-6h87
-
minimos
MINI-5rf7-7h2c-w978
-
minimos
MINI-66vm-cvqr-w29q
-
minimos
MINI-6vm2-gw3r-44x9
-
minimos
MINI-73vm-f4h2-6wq4
-
minimos
MINI-74c8-6793-q8jx
-
minimos
MINI-752g-wfw3-qv3w
-
minimos
MINI-76h8-92x2-6mcj
-
minimos
MINI-787j-8j2q-9573
-
minimos
MINI-78qx-gjwp-jr2c
-
minimos
MINI-7cxr-r8qc-657g
-
minimos
MINI-7jqw-6gj9-923v
-
minimos
MINI-7w5x-4fv6-fwc2
-
minimos
MINI-849v-wp33-vx57
-
minimos
MINI-8g7w-w558-gmrj
-
minimos
MINI-989x-gcm6-4rmj
-
minimos
MINI-9j56-wj9g-pvm7
-
minimos
MINI-9jc6-834q-hv5c
-
minimos
MINI-c2c3-6xx8-5mjx
-
minimos
MINI-c4r4-3pfm-xw45
-
minimos
MINI-c5vq-mq96-x5mv
-
minimos
MINI-c9mw-33ff-rpvj
-
minimos
MINI-chpw-f69f-qjgv
-
minimos
MINI-cqhx-8g7x-f78q
-
minimos
MINI-f678-rxj5-xgc3
-
minimos
MINI-f7h3-4qg9-2fcx
-
minimos
MINI-f947-5hr5-crgg
-
minimos
MINI-f95m-5cf7-4c43
-
minimos
MINI-fmfx-p38c-r6x9
-
minimos
MINI-gfq3-3f65-95gg
-
minimos
MINI-gj4c-3xvr-22pf
-
minimos
MINI-gx2g-4wc2-3jvx
-
minimos
MINI-hgj6-5vxp-7cx3
-
minimos
MINI-j7fq-6jp2-jwv6
-
minimos
MINI-j864-fr9w-pc5r
-
minimos
MINI-j9fh-x5m5-vpmv
-
minimos
MINI-jc7x-33j4-wwmf
-
minimos
MINI-jq9h-hcx7-f8p3
-
minimos
MINI-jvf8-rw29-53pc
-
minimos
MINI-jww4-5xff-3285
-
minimos
MINI-m96p-ghfq-96w2
-
minimos
MINI-m9v7-3v2r-h3qh
-
minimos
MINI-p7fc-c3hc-q4xf
-
minimos
MINI-pjrm-7xgr-277v
-
minimos
MINI-pmrv-gr6x-549w
-
minimos
MINI-pp9m-8r36-cqmq
-
minimos
MINI-pv8g-9jpc-rxrp
-
minimos
MINI-q54p-48vr-279m
-
minimos
MINI-qccx-9436-q774
-
minimos
MINI-qfx7-c6rj-39vv
-
minimos
MINI-qjcm-7pp2-w355
-
minimos
MINI-rh3g-h222-6rp2
-
minimos
MINI-v3j3-jc8h-hgrx
-
minimos
MINI-vqcf-pgxg-52f5
-
minimos
MINI-vrj8-hqj3-mq39
-
minimos
MINI-w482-6p7m-45x4
-
minimos
MINI-w6gf-gm7g-c8mh
-
minimos
MINI-w7q9-2p85-mw23
-
minimos
MINI-w95x-5mf7-2373
-
minimos
MINI-w9jq-2v73-747c
-
minimos
MINI-wv66-7m56-hmxx
-
minimos
MINI-wwjv-x3cr-c64p
-
minimos
MINI-xc5r-87cm-q5hv
-
minimos
MINI-xcmv-p5x8-x96m
-
minimos
MINI-xhp3-9prp-qf3w
-
minimos
MINI-xx8q-7gv9-vx7f
-