GHSA-wv8q-qhhj-9h54

Suggest an improvement
Source
https://github.com/advisories/GHSA-wv8q-qhhj-9h54
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-wv8q-qhhj-9h54
Aliases
Published
2026-09-30T15:36:55Z
Modified
2026-09-30T15:45:07Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
jackson-databind retains every unknown raw type ID
Details

Summary

With @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unknown raw type ID selects the same fallback deserializer but is retained as a separate key in TypeDeserializerBase._deserializers. An attacker who can repeatedly supply new unknown type IDs can grow this process-lifetime cache without a configured bound.

Details

The affected path is TypeDeserializerBase._findDeserializer(). After an unknown name-based type ID resolves to the configured fallback/default implementation, jackson-databind caches the result under the attacker-provided raw typeId. Although all such IDs select the same fallback deserializer, each new string remains a distinct cache key.

The behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1. Current 2.22 and 3.2 source branches retained the unbounded _deserializers map and per-raw-ID cache write when rechecked. The earlier affected floor has not been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.

The vulnerable application must enable name-based polymorphism with a defaultImpl or equivalent fallback, accept attacker-influenced type IDs, and reuse a long-lived mapper/type deserializer across requests.

Suggested correction: avoid caching each unknown raw ID when every such ID resolves to the same fallback, use a fallback sentinel, or use an explicitly bounded concurrency-safe cache. A regression should contrast many distinct unknown IDs with repetitions of one unknown ID across requests.

PoC

Configure a polymorphic base type with @JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class) and deserialize inputs containing unknown type names through the same mapper. Inspect TypeDeserializerBase._deserializers after the run.

On affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce 10,000 retained cache entries even though every input selects the same fallback deserializer. A matched control that repeats one unknown ID 10,000 times produces one retained entry. This isolates attacker-controlled key cardinality from ordinary request count.

Impact

Where the stated polymorphic fallback configuration is exposed to attacker-influenced type IDs, distinct inputs cause incremental process-lifetime memory retention and eventual availability pressure or denial of service. This is not claimed as a single-request allocation spike, and no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No confidentiality, integrity, or code-execution impact is claimed.

Requested credit: Daniel Birtwhistle

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-30T15:36:55Z",
    "nvd_published_at": "2026-09-23T03:17:04Z",
    "severity": "HIGH"
}
References

Affected packages

Maven
com.fasterxml.jackson.core:jackson-databind

Package

Name
com.fasterxml.jackson.core:jackson-databind
View open source insights on deps.dev
Purl
pkg:maven/com.fasterxml.jackson.core/jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.18.11

Affected versions

2.*
2.0.0
2.0.1
2.0.2
2.0.4
2.0.5
2.0.6
2.1.0
2.1.1
2.1.2
2.1.3
2.1.4
2.1.5
2.2.0-rc1
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.3.0-rc1
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.4.0-rc1
2.4.0-rc2
2.4.0-rc3
2.4.0
2.4.1
2.4.1.1
2.4.1.2
2.4.1.3
2.4.2
2.4.3
2.4.4
2.4.5
2.4.5.1
2.4.6
2.4.6.1
2.5.0-rc1
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.6.0-rc1
2.6.0-rc2
2.6.0-rc3
2.6.0-rc4
2.6.0
2.6.1
2.6.2
2.6.3
2.6.4
2.6.5
2.6.6
2.6.7
2.6.7.1
2.6.7.2
2.6.7.3
2.6.7.4
2.6.7.5
2.7.0-rc1
2.7.0-rc2
2.7.0-rc3
2.7.0
2.7.1
2.7.1-1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.9.1
2.7.9.2
2.7.9.3
2.7.9.4
2.7.9.5
2.7.9.6
2.7.9.7
2.8.0.rc1
2.8.0.rc2
2.8.0
2.8.1
2.8.2
2.8.3
2.8.4
2.8.5
2.8.6
2.8.7
2.8.8
2.8.8.1
2.8.9
2.8.10
2.8.11
2.8.11.1
2.8.11.2
2.8.11.3
2.8.11.4
2.8.11.5
2.8.11.6
2.9.0
2.9.0.pr1
2.9.0.pr2
2.9.0.pr3
2.9.0.pr4
2.9.1
2.9.2
2.9.3
2.9.4
2.9.5
2.9.6
2.9.7
2.9.8
2.9.9
2.9.9.1
2.9.9.2
2.9.9.3
2.9.10
2.9.10.1
2.9.10.2
2.9.10.3
2.9.10.4
2.9.10.5
2.9.10.6
2.9.10.7
2.9.10.8
2.10.0
2.10.0.pr1
2.10.0.pr2
2.10.0.pr3
2.10.1
2.10.2
2.10.3
2.10.4
2.10.5
2.10.5.1
2.11.0.rc1
2.11.0
2.11.1
2.11.2
2.11.3
2.11.4
2.12.0-rc1
2.12.0-rc2
2.12.0
2.12.1
2.12.2
2.12.3
2.12.4
2.12.5
2.12.6
2.12.6.1
2.12.7
2.12.7.1
2.12.7.2
2.13.0-rc1
2.13.0-rc2
2.13.0
2.13.1
2.13.2
2.13.2.1
2.13.2.2
2.13.3
2.13.4
2.13.4.1
2.13.4.2
2.13.5
2.14.0-rc1
2.14.0-rc2
2.14.0-rc3
2.14.0
2.14.1
2.14.2
2.14.3
2.15.0-rc1
2.15.0-rc2
2.15.0-rc3
2.15.0
2.15.1
2.15.2
2.15.3
2.15.4
2.16.0-rc1
2.16.0
2.16.1
2.16.2
2.17.0-rc1
2.17.0
2.17.1
2.17.2
2.17.3
2.18.0-rc1
2.18.0
2.18.1
2.18.2
2.18.3
2.18.4
2.18.5
2.18.6
2.18.7
2.18.8
2.18.9
2.18.10

Database specific

last_known_affected_version_range 
"<= 2.18.10"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json"
com.fasterxml.jackson.core:jackson-databind

Package

Name
com.fasterxml.jackson.core:jackson-databind
View open source insights on deps.dev
Purl
pkg:maven/com.fasterxml.jackson.core/jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.19.0
Fixed
2.21.7

Affected versions

2.*
2.19.0
2.19.1
2.19.2
2.19.3
2.19.4
2.20.0-rc1
2.20.0
2.20.1
2.20.2
2.21.0
2.21.1
2.21.2
2.21.3
2.21.4
2.21.5
2.21.6

Database specific

last_known_affected_version_range 
"<= 2.21.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json"
com.fasterxml.jackson.core:jackson-databind

Package

Name
com.fasterxml.jackson.core:jackson-databind
View open source insights on deps.dev
Purl
pkg:maven/com.fasterxml.jackson.core/jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.22.0
Fixed
2.22.3

Affected versions

2.*
2.22.0
2.22.1
2.22.2

Database specific

last_known_affected_version_range 
"<= 2.22.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json"
tools.jackson.core:jackson-databind

Package

Name
tools.jackson.core:jackson-databind
View open source insights on deps.dev
Purl
pkg:maven/tools.jackson.core/jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.0.0
Fixed
3.1.7

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0-rc1
3.1.0
3.1.1
3.1.2
3.1.3
3.1.4
3.1.5
3.1.6

Database specific

last_known_affected_version_range 
"<= 3.1.6"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json"
tools.jackson.core:jackson-databind

Package

Name
tools.jackson.core:jackson-databind
View open source insights on deps.dev
Purl
pkg:maven/tools.jackson.core/jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.2.0
Fixed
3.2.3

Affected versions

3.*
3.2.0
3.2.1
3.2.2

Database specific

last_known_affected_version_range 
"<= 3.2.2"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-wv8q-qhhj-9h54/GHSA-wv8q-qhhj-9h54.json"