Critical Security Update for pki-jackson-databind: Denial of Service Vulnerability
Summary
ALSA-2026:85231: Important: jackson-databind security update. Affects pki-jackson-databind versions < 2.21.6-1.el9_8.1. Fixed in 2.21.6-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pki-jackson-databind is a package that provides general-purpose data-binding functionality and a tree-model for the Jackson Data Processor. It leverages the core streaming parser/generator package and utilizes Jackson Annotations for configuration. This package is widely used in Java applications for processing JSON data. However, it is susceptible to a Denial of Service (DoS) attack due to a vulnerability that allows for quadratic forward-reference completion, potentially leading to resource exhaustion.
Vulnerability Detail
The vulnerability, identified as CVE-2026-91777, arises from the way pki-jackson-databind handles forward references during data binding. An attacker can exploit this flaw by crafting specific input that causes the application to enter a state of excessive resource consumption, leading to a Denial of Service. This can result in application crashes or unresponsiveness, severely impacting availability and user experience.
How To Fix
Minimum fixed version
2.21.6-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update pki-jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation to restrict the types of data that can be processed by the application. This can help mitigate the risk of exploitation until the package can be updated.
Conclusion
The pki-jackson-databind package has a critical vulnerability that can lead to Denial of Service attacks. It is crucial to update to the latest patched version to protect your applications. Additionally, consider using input validation as a temporary workaround until the update can be applied.
See every vulnerability recorded for pki-jackson-databind →
FAQ
CVE-2026-91777 is a vulnerability in the pki-jackson-databind package that allows for Denial of Service attacks through quadratic forward-reference completion.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to application crashes or unresponsiveness, severely affecting the availability of your services.
Yes, a patched version of pki-jackson-databind is available. Update to version 2.21.6-1.el9_8.1 to mitigate the risk.
Implement input validation to restrict the types of data processed by your application as a temporary measure until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for pki-jackson-databind.
