CVE-2026-91777

🗓️ 23 Sep 2026 02:21:48Reported by MendType

mend🔗 www.mend.io👁 14 Views

Quadratic CPU work during deserialization in jackson-databind for identity-enabled maps.

Reporter	Title	Published	Views	Family All 1000
IBM Security Bulletins	Security Bulletin:Multiple vulnerabilities in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-91776, CVE-2026-91777)	23 Oct 202608:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by multiple vulnerabilities in Jackson Databind	14 Oct 202617:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Integration Designer is vulnerable to multiple CVEs	16 Oct 202619:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to Uncontrolled Resource Consumption issues in FasterXML jackson-databind	22 Oct 202620:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM ApplinX is vulnerable to multiple vulnerabilities due to use of Apache Log4j, FasterXML jackson-databind, FasterXML jackson-core, and Bouncy Castle libraries	14 Oct 202607:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities	19 Oct 202618:43	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerabilities exists in Jackson package used by IBM Netezza Appliance	12 Oct 202607:49	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability has been detected in IBM Security Verify Governance Identity Manager Adapters	15 Oct 202606:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses jackson-databind-2.18.10.jar which is vulnerable to CVE-2026-91776, CVE-2026-91777.	27 Oct 202613:57	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access	30 Oct 202600:40	–	ibm

Vulners

Node

fasterxml jackson-databindRange2.22.0–2.22.3

fasterxml jackson-databindRange3.2.0–3.2.3

fasterxml jackson-databindRange2.4.0-rc1–2.18.11

fasterxml jackson-databindRange3.0.0–3.1.7

fasterxml jackson-databindRange2.19.0–2.21.7

fasterxml jackson-databindRange2.5.0–2.18.11

fasterxml jackson-databindRange2.19.0-rc2–2.21.7

fasterxml jackson-databindRange3.0.0-rc1–3.1.7

Source	Link
github	www.github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3
github	www.github.com/FasterXML/jackson-databind
github	www.github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7
github	www.github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67
github	www.github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-91777
repo1	www.repo1.maven.org/maven2
github	www.github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91777.json
github	www.github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11

08 Oct 2026 07:28Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

CVSS 48.7

EPSS0.00487

SSVC

CWE-400