Resource exhaustion in jackson-databind - CVE-2026-91776

Vulnerability identifier: #VU151565

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-91776

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in TypeDeserializerBase._findDeserializer() and its _deserializers cache when processing attacker-influenced unknown type IDs with name-based polymorphism and a configured fallback implementation. A remote attacker can supply distinct unknown type IDs to cause a denial of service.

Exploitation requires reuse of a long-lived mapper or type deserializer across requests.

jackson-databind
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Development Tools Module
Basesystem Module
Db2 Developer Extension
Test Accelerator for Z - Early Development Testing Eclipse
IBM Maximo Scheduler Optimization
CICS Transaction Gateway Desktop Edition
Security Verify Governance Adapter for CyberArk
Terracotta
InfoSphere Data Replication
IBM SPSS Collaboration and Deployment Services
IBM SPSS Modeler
IBM Business Automation Workflow
IBM Netezza Performance Server
Oracle Global Lifecycle Management NextGen OUI Framework
jackson-annotations
jackson-dataformat-cbor
jackson-core
jackson-databind
jackson-dataformat-xml

Install security update from vendor's website.

jackson-databind - addressed in versions 2.8.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3
Db2 Developer Extension - update to 1.2.1
Test Accelerator for Z - Early Development Testing Eclipse - update to 3.1.0
IBM Maximo Scheduler Optimization - addressed in versions 9.0.28, 9.1.17, 9.2.4
Terracotta - addressed in versions 10.15.0.40, 11.1.0.23, 12.1.0.5
IBM SPSS Modeler - update to 19.0.0.0 IF035
jackson-annotations - update to 2.18.11-150200.3.28.1
jackson-dataformat-cbor - update to 2.18.11-150200.3.29.1
jackson-core - update to 2.18.11-150200.3.30.1
jackson-databind - update to 2.18.11-150200.3.36.1
jackson-dataformat-xml - update to 2.18.11-150200.5.8.1
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54

• Multiple vulnerabilities in jackson-databind
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Netezza Performance Server
• Multiple vulnerabilities in IBM Security Verify Governance Adapter for CyberArk
• Multiple vulnerabilities in IBM Terracotta
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM SPSS Modeler
• Multiple vulnerabilities in IBM Test Accelerator for Z - Early Development Testing Eclipse
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Multiple vulnerabilities in IBM Maximo Scheduler Optimization
• Multiple vulnerabilities in InfoSphere Data Replication
• Multiple vulnerabilities in IBM CICS Transaction Gateway Desktop Edition
• Multiple vulnerabilities in Oracle Global Lifecycle Management NextGen OUI Framework
• SUSE update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base