Critical Security Flaw in jackson-databind: Denial of Service Vulnerability
Summary
RLSA-2026:85231: Important: jackson-databind security update. Affects jackson-databind versions < 0:2.21.6-1.el9_8.1. Fixed in 0:2.21.6-1.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Jackson-databind is a core component of the Jackson Data Processor, which provides general-purpose data-binding functionality and a tree-model for processing JSON data. It builds on the core streaming parser and generator package and utilizes Jackson Annotations for configuration. This package is widely used in Java applications for converting Java objects to JSON and vice versa, making it a critical component in many software systems.
Vulnerability Detail
The vulnerability identified as CVE-2026-91777 in jackson-databind allows for a Denial of Service (DoS) attack through quadratic forward-reference completion. This occurs when an attacker can exploit the data-binding functionality to create a scenario where the processing time grows quadratically with the size of the input data, potentially leading to service unavailability. The impact of this vulnerability is significant, as it can cause applications to become unresponsive, affecting user experience and system reliability.
How To Fix
Minimum fixed version
0:2.21.6-1.el9_8.1
This is the first release that contains the fix.
sudo dnf update jackson-databindTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may limit the size of the input data being processed by jackson-databind to reduce the risk of triggering the vulnerability. However, this is not a permanent solution and updating the package is strongly recommended.
Conclusion
In summary, the jackson-databind package has a critical vulnerability (CVE-2026-91777) that can lead to Denial of Service attacks. It is crucial to update to the patched version to ensure the security and reliability of your applications. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for jackson-databind →
FAQ
CVE-2026-91777 is a vulnerability in jackson-databind that allows for Denial of Service attacks through quadratic forward-reference completion.
This vulnerability can cause your application to become unresponsive, leading to a poor user experience and potential downtime.
If immediate updates are not possible, consider implementing input size limitations as a temporary workaround until you can apply the patch.
More details can be found on the CVE page for CVE-2026-91777 and through security advisories from the Rocky Enterprise Software Foundation.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for jackson-databind.
