FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

jackson-databind -- denial of service

Affected packages
		jackson-databind	<	2.22.3

Details

VuXML ID	7b3ea5d6-cf3d-11f1-a655-3497f65b111b
Discovery	2026-09-21
Entry	2026-10-22

The Jackson project reports:

CVE-2026-91776: TypeDeserializerBase caches the resolved deserializer under the raw, attacker supplied type id. With name based polymorphism and a fallback, every unrecognized type id adds an entry and the cache grows without bound.

CVE-2026-91777: forward reference completion for JsonIdentityInfo object ids scans the pending reference accumulator for every resolved id, which is quadratic in the number of references.

[source]

References

CVE Name	CVE-2026-91776
CVE Name	CVE-2026-91777
URL	https://github.com/FasterXML/jackson-databind/blob/2.x/release-notes/VERSION-2.x