jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID

Versions reported by the vendor

Affected version ranges reported by the assigning authority (HeroDevs). Independent of NVD's CPE analysis and usually ahead of it.

• FasterXML jackson-databind

  • 2.0.0 and later · up to and including 2.18.10affected · maven
  • 2.19.0 and later · up to and including 2.21.6affected · maven
  • 2.22.0 and later · up to and including 2.22.2affected · maven
  • 3.0.0 and later · up to and including 3.1.6affected · maven
  • 3.2.0 and later · up to and including 3.2.2affected · maven

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2017-17485FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix
  54Plan
• CVE-2017-7525A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthentica
  50Plan
• CVE-2020-8840FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi
  47Plan

Published before and after this one in the same product

• ← EarlierCVE-2026-83557Sep 1, 2026 · jackson-databind omits java.lang.Comparable from DefaultBaseTypeLimitingValidator's unsafe base types
  22Monitor
• ← EarlierCVE-2026-68497Sep 11, 2026 · jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service
  30Monitor
• Later →CVE-2026-91777Sep 22, 2026 · jackson-databind: quadratic forward-reference completion in Collection and Map deserializers
  30Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.