Memory Retention Vulnerability in FasterXML Jackson Databind

CVE-2026-91776

What is CVE-2026-91776?

The vulnerability involves improper handling of type IDs within the FasterXML Jackson Databind library, specifically in the TypeDeserializerBase._findDeserializer() method. Attackers can exploit name-based polymorphism configurations that utilize a fallback deserializer. When an application processes these type IDs, unrecognized types cause the retention of fallback entries in the _deserializers map, leading to significant memory retention. This affects systems that allow attacker-controlled type IDs and maintain a long-lived ObjectMapper, necessitating monitoring and implementation of patch updates to prevent exploitation.

References