Resource exhaustion in jackson-databind - CVE-2026-91777

Vulnerability identifier: #VU151566

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-91777

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in forward-reference completion in CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the corresponding map implementation when resolving reverse-order object-ID references during deserialization. A remote attacker can submit JSON containing unresolved identity references followed by definitions of the same IDs in reverse order to cause a denial of service.

Exploitation requires the application to deserialize JSON into an identity-enabled collection or map.

jackson-databind
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Development Tools Module
Basesystem Module
Fedora
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
jackson-parent
jackson-annotations
jackson-dataformat-cbor
jackson-core
jackson-databind
jackson-dataformat-xml
jackson-modules-base
jackson-jaxrs-providers
jackson-bom
jackson-core (Red Hat package)
jackson-jaxrs-providers (Red Hat package)
jackson-modules-base (Red Hat package)
jackson-databind (Red Hat package)
fasterxml-oss-parent
Db2 Developer Extension
Test Accelerator for Z - Early Development Testing Eclipse
IBM Maximo Scheduler Optimization
CICS Transaction Gateway Desktop Edition
Security Verify Governance Adapter for CyberArk
Terracotta
InfoSphere Data Replication
IBM SPSS Collaboration and Deployment Services
IBM SPSS Modeler
IBM Business Automation Workflow
IBM Netezza Performance Server

Install security update from vendor's website.

jackson-databind - addressed in versions 2.18.11, 2.21.7, 2.22.3, 3.1.7, 3.2.3
Db2 Developer Extension - update to 1.2.1
Test Accelerator for Z - Early Development Testing Eclipse - update to 3.1.0
IBM Maximo Scheduler Optimization - addressed in versions 9.0.28, 9.1.17, 9.2.4
Terracotta - addressed in versions 10.15.0.40, 11.1.0.23, 12.1.0.5
IBM SPSS Modeler - update to 19.0.0.0 IF035
jackson-parent - update to 2.18.4-1.fc44
jackson-annotations - update to 2.18.11-150200.3.28.1
jackson-dataformat-cbor - update to 2.18.11-150200.3.29.1
jackson-core - update to 2.18.11-150200.3.30.1
jackson-databind - update to 2.18.11-150200.3.36.1
jackson-dataformat-xml - update to 2.18.11-150200.5.8.1
jackson-modules-base - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-jaxrs-providers - update to 2.18.12-1.fc44
jackson-databind - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-core - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-bom - addressed in versions 2.18.12-1.fc44, 2.21.8-1.fc45, 2.21.8-1.fc46
jackson-annotations - update to 2.18.12-1.fc44
jackson-core (Red Hat package) - update to 2.21.6-1.el9_6
jackson-jaxrs-providers (Red Hat package) - update to 2.21.6-1.el9_6
jackson-modules-base (Red Hat package) - update to 2.21.6-1.el9_6
jackson-databind (Red Hat package) - update to 2.21.6-1.el9_8.1
fasterxml-oss-parent - update to 69-1.fc44
IBM Netezza Performance Server - update to 11.3.1.3 IF6
InfoSphere Data Replication - update to 11.4.0.5-5826

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24

• Multiple vulnerabilities in jackson-databind
• Multiple vulnerabilities in IBM Business Automation Workflow
• Multiple vulnerabilities in IBM Netezza Performance Server
• Multiple vulnerabilities in IBM Security Verify Governance Adapter for CyberArk
• Red Hat Enterprise Linux 9 update for jackson-databind
• Multiple vulnerabilities in IBM Terracotta
• Multiple vulnerabilities in IBM SPSS Collaboration and Deployment Services
• Multiple vulnerabilities in IBM SPSS Modeler
• Red Hat Enterprise Linux 9 update for multiple packages
• Multiple vulnerabilities in IBM Test Accelerator for Z - Early Development Testing Eclipse
• Multiple vulnerabilities in IBM Db2 Developer Extension
• Fedora 46 update for jackson-bom, jackson-core, jackson-databind, jackson-modules-base
• Multiple vulnerabilities in IBM Maximo Scheduler Optimization
• Fedora 45 update for jackson-bom, jackson-core, jackson-databind, jackson-modules-base
• Fedora 44 update for fasterxml-oss-parent, jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-jaxrs-providers, jackson-modules-base, jackson-parent
• Multiple vulnerabilities in InfoSphere Data Replication
• Multiple vulnerabilities in IBM CICS Transaction Gateway Desktop Edition
• SUSE update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformat-xml, jackson-dataformats-binary, jackson-modules-base