Performance Impact in FasterXML Jackson Databind Due to Inefficient Deserialization Process

CVE-2026-91777

What is CVE-2026-91777?

A performance vulnerability in FasterXML's jackson-databind occurs during the deserialization of JSON documents featuring unresolved object-ID references. Specifically, the issue arises in identity-enabled collections and maps, where a forward-reference completion process leads to inefficient, quadratic CPU resource consumption. This vulnerability becomes particularly significant when documents define multiple unresolved IDs in a reverse order, ultimately resulting in extensive identity comparisons that degrade application performance. The underlying problem is resolved by implementing a more efficient keyed pending-reference structure, enhancing deserialization speed and reducing CPU overhead.

References