« Volver al listado

CVE-2026-91776

Estado: AplazadaAlta (7.5)—

TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map.

Leer descripción completaMostrar menos

That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de desserialización en aplicación expuesta (T1190) que causa retención ilimitada de memoria (DoS por agotamiento de recursos, T1499.004) explotable remotamente sin autenticación mediante IDs de tipo desconocidos repetidos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Fasterxml — Jackson-databindAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-91776",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-91776",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-23T14:02:42.582789Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "affectedData": [
        {
          "repo": "https://github.com/FasterXML/jackson-databind",
          "vendor": "FasterXML",
          "product": "jackson-databind",
          "versions": [
            {
              "status": "affected",
              "version": "2.0.0",
              "versionType": "maven",
              "lessThanOrEqual": "2.18.10"
            },
            {
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven",
              "lessThanOrEqual": "2.21.6"
            },
            {
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven",
              "lessThanOrEqual": "2.22.2"
            }
          ],
          "packageName": "com.fasterxml.jackson.core:jackson-databind",
          "collectionURL": "https://repo1.maven.org/maven2",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "com.fasterxml.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"
            }
          ]
        },
        {
          "repo": "https://github.com/FasterXML/jackson-databind",
          "vendor": "FasterXML",
          "product": "jackson-databind",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven",
              "lessThanOrEqual": "3.1.6"
            },
            {
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven",
              "lessThanOrEqual": "3.2.2"
            }
          ],
          "packageName": "tools.jackson.core:jackson-databind",
          "collectionURL": "https://repo1.maven.org/maven2",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "tools.jackson.databind.jsontype.impl.TypeDeserializerBase._findDeserializer"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-09-23T03:17:04.620",
  "references": [
    {
      "url": "https://github.com/FasterXML/jackson-databind/issues/6203",
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    },
    {
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54",
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    },
    {
      "url": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID."
    }
  ],
  "lastModified": "2026-09-24T20:43:32.537",
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c"
}