CVE-2026-91777

Name of the Vulnerable Software and Affected Versions FasterXML jackson-databind (affected versions not specified)

Description Forward-reference completion for @JsonIdentityInfo object IDs performs a linear scan of the pending-reference accumulator for every resolved ID. This occurs within the CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() function and the corresponding implementation in MapDeserializer. If a document creates N unresolved object-ID references in an identity-enabled collection or map and subsequently defines those IDs in reverse order, the system performs quadratic CPU work during deserialization. This allows a shallow document to cause excessive CPU consumption through a high number of identity comparisons.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.