CVE-2026-91777: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-91777 is a denial-of-service vulnerability in FasterXML jackson-databind caused by quadratic CPU consumption during forward-reference resolution for @JsonIdentityInfo-annotated collections and maps. Discovered and reported by Daniel Birtwhistle, it was published on September 22–23, 2026. Affected versions include com.fasterxml.jackson.core:jackson-databind 2.5.0–2.18.10, 2.19.0–2.21.6, and 2.22.0–2.22.2, as well as tools.jackson.core:jackson-databind 3.0.0–3.1.6 and 3.2.0–3.2.2. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The root cause (CWE-400: Uncontrolled Resource Consumption) lies in CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent MapDeserializer.MapReferringAccumulator implementation, both of which perform a linear scan of the pending-reference accumulator for every resolved object ID. When a JSON document first creates N unresolved @JsonIdentityInfo object-ID references and then defines those IDs in reverse order, the resolution performs approximately N × (N + 1) / 2 identity comparisons — quadratic growth relative to document size. At N=2,000, exactly 2,003,000 equals() calls were measured, versus zero in a same-sized control where all references were pre-resolved. The attack requires no deep nesting or syntactically unusual JSON; the only precondition is that the target application deserializes attacker-controlled JSON into an identity-enabled collection or map. The fix replaces the linear list scan with a keyed (map-based) pending-reference structure, reducing resolution to O(N) (GitHub Advisory, GitHub PR #6204).

Successful exploitation causes quadratic CPU consumption during JSON deserialization, enabling an unauthenticated remote attacker to exhaust request-time or worker-capacity budgets and cause denial of service. There is no confidentiality, integrity, or code-execution impact — the vulnerability is purely an availability issue. Applications that accept attacker-influenced JSON and deserialize it into @JsonIdentityInfo-annotated collections or maps are at risk; the severity is proportional to how much attacker control exists over input size and structure (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the target application to use @JsonIdentityInfo on a collection or map and to accept attacker-supplied JSON, which is a meaningful but not uncommon configuration in Java web services (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Java applications that use jackson-databind for JSON deserialization and accept user-supplied JSON input (e.g., REST APIs). Confirm the application uses @JsonIdentityInfo on collection or map types by reviewing API documentation, error messages, or source code if available.
2. Craft malicious payload: Construct a shallow JSON document containing N forward references to @JsonIdentityInfo object IDs that have not yet been defined, followed by definitions of those same IDs in reverse order (last ID defined first). No deep nesting is required.
3. Scale the payload: Increase N to a value sufficient to cause significant CPU load (e.g., N=2,000 produces ~2,003,000 ID comparisons; larger N causes quadratic growth). The document remains syntactically valid JSON.
4. Submit the payload: Send the crafted JSON to the target endpoint via HTTP POST or another applicable method. No authentication is required if the endpoint is public.
5. Achieve denial of service: The server's deserialization thread consumes quadratic CPU time processing the payload, exhausting worker capacity or request timeouts and causing service degradation or outage for legitimate users (GitHub Advisory, GitHub PR #6204).

• Network: Repeated HTTP requests to JSON-accepting endpoints with large but syntactically valid payloads; payloads containing many @id or @ref fields in reverse-order patterns.
• Logs: Application logs showing deserialization timeouts or thread pool exhaustion; elevated CPU usage correlated with specific JSON deserialization requests; request processing times growing non-linearly with payload size.
• Process: Java worker threads pegged at 100% CPU for extended periods during JSON parsing; JVM thread dumps showing threads stuck in CollectionReferringAccumulator.resolveForwardReference() or MapReferringAccumulator stack frames.

FasterXML has released patched versions that replace the linear scan with a keyed pending-reference structure: 2.18.11, 2.21.7, 2.22.3 (for com.fasterxml.jackson.core:jackson-databind), and 3.1.7, 3.2.3 (for tools.jackson.core:jackson-databind). Upgrading to one of these versions is the recommended remediation. As a workaround where upgrading is not immediately possible, applications can validate or limit the size of incoming JSON payloads, or avoid exposing @JsonIdentityInfo-annotated collection/map endpoints to untrusted input (GitHub Advisory, GitHub PR #6204).

The fix was developed by contributor pjfanning and merged by cowtowncoder (FasterXML maintainer) on September 15, 2026, ahead of the public advisory on September 22, 2026. Downstream projects such as astubbs/parallel-consumer and multiple Exasol repositories quickly opened dependency-update issues referencing CVE-2026-91777, indicating broad awareness in the Java ecosystem. The advisory credits Daniel Birtwhistle as the reporter (GitHub Advisory, GitHub PR #6204).