Performance Degradation in jackson-databind Due to Forward-Reference Completion Vulnerability
Summary
DEBIAN-CVE-2026-91777: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. Affects jackson-databind versions 2.14.0+ds-1 – 2.14.0-1+deb12u1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
jackson-databind is a core component of the FasterXML Jackson library, widely used for converting Java objects to JSON and vice versa. It provides powerful data-binding capabilities and is integral to many Java applications that require JSON processing. However, it is susceptible to a performance-related vulnerability that can lead to significant CPU overhead during deserialization, particularly when handling identity-enabled collections or maps.
Vulnerability Detail
The vulnerability arises from the forward-reference completion mechanism for @JsonIdentityInfo object IDs in jackson-databind. Specifically, the methods CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent in MapDeserializer perform a linear scan of unresolved object-ID references. When a document creates N unresolved references and defines those IDs in reverse order, the completion process incurs a quadratic number of identity comparisons, leading to severe performance degradation. This can result in applications consuming excessive CPU resources, particularly when deserializing large JSON documents influenced by attackers.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider avoiding the use of identity-enabled collections or maps when deserializing JSON documents that may contain attacker-influenced data. This can help mitigate the performance impact until the package is updated.
Conclusion
The jackson-databind library is vulnerable to a performance degradation issue due to inefficient forward-reference completion for object IDs. It is crucial to update to the latest patched version to avoid excessive CPU usage during JSON deserialization. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2026-91777 is a vulnerability in the jackson-databind library that causes performance degradation due to inefficient handling of forward-reference completions for object IDs.
If your application deserializes JSON into identity-enabled collections or maps, it may experience significant CPU overhead, especially with large or complex JSON documents.
Yes, a patched version of jackson-databind is available. It is recommended to update to the latest version to mitigate the vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
