CVE-2026-91777

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

CVE-2026-91777 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

CVE-2026-91777

The FasterXML jackson-databind library is vulnerable to a quadratic CPU work issue during deserialization. The root cause lies in the CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() (and the equivalent in MapDeserializer ) methods, where forward-reference completio...

EUVD-2026-85003

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference and the equivalent...

CVE-2026-85999 Soup Sieve: Polynomial-time ReDoS (O(n²)) in the whitespace/comment trimming regex `RE_WS_END` (triggers on VALID selectors)

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selectoriter in src/soupsieve/cssparser.py trims the raw selector with REWSEND, an end-anchored WSC whitespace-and-comment expression used with search, so the regular expression engine retries a greedy...