https://vulnerability.circl.lu/sightings/feed 2026-10-01T19:26:47.727062+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/493092f2-dca5-4128-9da2-4e021baefadd/export 2026-10-01T19:26:47.759579+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "493092f2-dca5-4128-9da2-4e021baefadd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91777", "type": "seen", "source": "https://gist.github.com/alon710/b2bed584e72773f226131a1df51cff3f", "content": "# CVE-2026-91777: CVE-2026-91777: Algorithmic Complexity Denial of Service in FasterXML jackson-databind\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91777\n\n## Summary\nAn uncontrolled resource consumption vulnerability in FasterXML jackson-databind allows remote unauthenticated attackers to cause a Denial of Service (DoS) via crafted JSON payloads containing out-of-order forward references in identity-enabled collections or maps.\n\n## TL;DR\nA quadratic-time algorithmic complexity flaw in Jackson's forward-reference resolution mechanism allows unauthenticated remote attackers to trigger severe CPU thread starvation by submitting specialized JSON payloads containing out-of-order references.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS Score**: 7.5 (High)\n- **EPSS Score**: 0.0045\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof of Concept available\n- **KEV Status**: Not currently listed\n\n## Affected Systems\n\n- jackson-databind\n- **jackson-databind**: >= 2.5.0, < 2.18.11 (Fixed in: `2.18.11`)\n- **jackson-databind**: >= 2.19.0, < 2.21.7 (Fixed in: `2.21.7`)\n- **jackson-databind**: >= 2.22.0, < 2.22.3 (Fixed in: `2.22.3`)\n- **jackson-databind**: >= 3.0.0, < 3.1.7 (Fixed in: `3.1.7`)\n- **jackson-databind**: >= 3.2.0, < 3.2.3 (Fixed in: `3.2.3`)\n\n## Mitigation\n\n- Upgrade jackson-databind to 2.18.11, 2.21.7, 2.22.3, 3.1.7, or 3.2.3 depending on major version line\n- Enforce maximum request size limits on HTTP endpoints utilizing Jackson deserialization\n- Avoid the use of @JsonIdentityInfo on models accepting untrusted user-controlled input\n\n**Remediation Steps:**\n1. Identify all direct and transitive dependencies containing 'jackson-databind' within dependency trees.\n2. Update project configuration files (pom.xml, build.gradle) to explicitly target safe versions.\n3. Redeploy application environments and verify thread resource performance during ingestion of out-of-order object graphs.\n\n## References\n\n- [GitHub Security Advisory GHSA-cxp5-3px4-pw24](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24)\n- [Fix Commit 37ad9b8](https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67)\n- [FasterXML databind Issue #6204](https://github.com/FasterXML/jackson-databind/issues/6204)\n- [NVD - CVE-2026-91777](https://nvd.nist.gov/vuln/detail/CVE-2026-91777)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91777) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-30T20:30:31.000000Z"} 2026-09-30T20:30:31+00:00 https://vulnerability.circl.lu/sighting/cd9f29b1-4318-456b-90f9-bfc2422bbb82/export 2026-10-01T19:26:47.763055+00:00 Joseph Lee https://cvepremium.circl.lu/user/syspect {"uuid": "cd9f29b1-4318-456b-90f9-bfc2422bbb82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-91777", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-cxp5-3px4-pw24", "content": "", "creation_timestamp": "2026-09-30T15:37:24.000000Z"} 2026-09-30T15:37:24+00:00