Vulnerabilities

Security fix · CVE-2026-91776

jackson-databind retains every unknown raw type ID

Published Sep 22, 2026 · catalog updated Sep 23, 2026 · jackson-databind retains every unknown

Last checked Nov 2, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-91776. EPSS is 0.49%. Act only if a listed version of jackson-databind retains every unknown is installed.

Severity

High7.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.49%

Remediation

Version ranges on file

Affected products

maven com.fasterxml.jackson.core:jackson-databind · maven tools.jackson.core:jackson-databind

### Summary With , every distinct unknown raw type ID selects the same fallback deserializer but is retained as a separate key in . An attacker who can repeatedly supply new unknown type IDs can grow this process-lifetime cache without a configured bound. ### Details The affected path is . After an unknown name-based type ID resolves to the configured fallback/default implementation, jackson-databind caches the result under the attacker-provided raw . Although all such IDs select the same fallback deserializer, each new string remains a distinct cache key. The behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1. Current 2.22 and 3.2 source branches retained the unbounded map and per-raw-ID cache write when rechecked. The earlier affected floor has not been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3. The vulnerable application must enable name-based polymorphism with a or equivalent fallback, accept attacker-influenced type IDs, and reuse a long-lived mapper/type deserializer across requests. Suggested correction: avoid caching each unknown raw ID when every such ID resolves to the same fallback, use a fallback sentinel, or use an explicitly bounded concurrency-safe cache. A regression should contrast many distinct unknown IDs with repetitions of one unknown ID across requests. ### PoC Configure a polymorphic base type with and deserialize inputs containing unknown type names through the same mapper. Inspect after the run. On affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce 10,000 retained cache entries even though every input selects the same fallback deserializer. A matched control that repeats one unknown ID 10,000 times produces one retained entry. This isolates attacker-controlled key cardinality from ordinary request count. No attachment is included initially. I can provide the compact 2.x and 3.x harnesses, artifact hashes, exact commands, and full controls through this private advisory