View Ridge Security
Back to Cyber Hose

jackson-databind quadratic forward-reference completion flaw enables

A high-severity DoS flaw in jackson-databind affects many versions and can cause quadratic CPU usage via JSON deserialization.

🕵️ RESEARCH & DEEP DIVES

  • jackson-databind quadratic forward-reference completion flaw enables DoS (CVE-2026-91777)
    A quadratic CPU-time deserialization flaw (CVE-2026-91777) was disclosed in FasterXML jackson-databind's @JsonIdentityInfo forward-reference handling.

    • Affects applications deserializing attacker-influenced JSON into identity-enabled collections or maps using @JsonIdentityInfo.
    • Affected versions: 2.19.0, 2.22.0, 3.0.0, 3.2.0 (Maven); 2.5.0 listed as unaffected; CVSS 7.5 High, CWE-400.
    • CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and MapDeserializer do a linear scan per resolved ID, yielding ~N*(N+1)/2 comparisons when IDs are defined in reverse order.
    • Measured 2,003,000 equals() comparisons at N=2,000; no deep nesting or unusual JSON needed.
    • Fix replaces the linear lookup with a keyed pending-reference structure; reported by Daniel Birtwhistle.
    Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

  • jackson-databind CVE-2026-91776: unbounded type id cache in TypeDeserializerBase enables memory exhaustion
    FasterXML jackson-databind has an unbounded type id cache that lets attackers cause uncontrolled memory retention (CVE-2026-91776).

    • Affects FasterXML jackson-databind versions 2.19.0, 2.22.0, 3.0.0, and 3.2.0 (Maven); rated HIGH 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), CWE-400.
    • TypeDeserializerBase._findDeserializer() caches resolved deserializers under raw, attacker-supplied type IDs; with name-based polymorphism and a fallback (e.g. @JsonTypeInfo(use = Id.NAME, defaultImpl = ...)), every distinct unrecognized type ID is retained as its own key in an unbounded _deserializers map.
    • The map lives for the lifetime of the type deserializer, so an attacker supplying fresh unknown type IDs causes monotonic memory retention; the reporter observed 10,000 retained entries from 10,000 distinct unknown IDs versus one entry for a repeated ID.
    • Exploitation requires an app with name-based polymorphism plus a defaultImpl fallback, attacker-influenced type IDs, and a long-lived ObjectMapper reused across requests.
    • The fix stops caching fallback resolutions for unrecognized IDs and bounds both cached entry count and cacheable type ID length; reported by Daniel Birtwhistle (dabirt).
    Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

  • iFlytek astron-agent SSRF flaw in UrlCheckTool.checkUrl fixed in reward-1575 (CVE-2026-95930)
    iFlytek astron-agent up to version 1.0.6 contains a server-side request forgery vulnerability in the debugToolV2 API endpoint.

    • Affects iFlytek astron-agent versions 1.0.0 through 1.0.6.
    • The UrlCheckTool.checkUrl function in the debugToolV2 API endpoint allows SSRF via manipulation of the endPoint argument.
    • The attack can be initiated remotely and requires low privileges (CVSS 3.1: 6.3).
    • Fixed in release reward-1575 via commit 45ee5fb647e9894e73b0d7720fa94a66e4540bbb.
    Sources 📄 Source: vuldb.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

  • jackson-core UTF8DataInputJsonParser unbounded token buffer enables DoS via DataInput parsers (CVE-2026-89425)
    FasterXML jackson-core's UTF8DataInputJsonParser can accumulate arbitrarily long malformed tokens in error messages, causing memory exhaustion.

    • Affects applications using jackson-core parsers created via JsonFactory.createParser(DataInput); the affected class was introduced in 2.8.0, with 2.19.0, 2.22.0, 3.0.0 and 3.2.0 listed as affected.
    • UTF8DataInputJsonParser._reportInvalidToken() appends Java identifier characters to a StringBuilder with no upper bound, ignoring ErrorReportConfiguration.getMaxErrorTokenLength() (default 256), unlike sibling parsers such as UTF8StreamJsonParser.
    • No StreamReadConstraints setting mitigates it: maxDocumentLength cannot apply to DataInput sources and maxStringLength is bypassed because accumulation skips ReadConstrainedTextBuffer.
    • A 20-million-character malformed token produced a 20,000,109-character exception message on the DataInput path versus 367 characters on the InputStream path; scaling can trigger JVM-wide OutOfMemoryError.
    • CVSS 3.1 score 7.5 (High, availability impact); reported by manqingzhou, tracked as GHSA-7hhh-6rmp-j9qf with fix in jackson-core PR #1698.
    Sources 📄 Source: github.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

  • iFlytek astron-agent getBotList API SQL injection fixed in reward-1575 (CVE-2026-95929)
    A SQL injection vulnerability in iFlytek astron-agent's getBotList API endpoint has been disclosed and patched.

    • Affects iFlytek astron-agent versions 1.0.0 through 1.0.7
    • SQL injection via the sortDirection argument in ChatBotMarketMapper.xml (console/backend/commons) of the getBotList API endpoint
    • Attack is remotely exploitable but requires low privileges; CVSS 3.1 score 6.3
    • Fixed in release reward-1575 via patch commit 6702be70ae802b1048f5fbec91e690e7b71a4165
    Sources 📄 Source: vuldb.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt

  • Two SQL injection flaws disclosed in SourceCodester Online Reviewer Management System 1.0
    Two SQL injection vulnerabilities were disclosed in SourceCodester Online Reviewer Management System 1.0.

    • Affects SourceCodester Online Reviewer Management System 1.0 (PHP/MySQL).
    • CVE-2026-95926: SQL injection via the test_id argument in /reviewer_0/admins/assessments/pretest/btn_functions.php?action=update.
    • CVE-2026-95925: SQL injection via the difficulty_id argument in /reviewer_0/admins/assessments/databank/btn_functions.php?action=update.
    • Both attacks are remotely exploitable without authentication; public exploits exist (CVSS 3.1: 7.3).
    • Reported by huliangjia via VulDB (entries VDB-408547 and VDB-408548).
    Sources 📄 Source: vuldb.com · 📎 Coverage: cve.threatint.com · 👁 via CVE ThreatInt (+1)

🕵️ RESEARCH & DEEP DIVES

  • recommenders-team recommenders Dict Loading mind_iterator.py pickle.load dese... — CVE ThreatInt

  • SourceCodester Online Reviewer Management System btn_functions.php add sql in... — CVE ThreatInt

  • Dask Loader core.py from_npy_stack deserializationA security vulnerability ha... — CVE ThreatInt

  • Ghidra before 12.1.4 Denial of Service via Crafted DatabaseGhidra before 12.1... — CVE ThreatInt

  • ClipBucket v5 before 5.5.3-#182 SQL Injection via search_result.phpClipBucket... — CVE ThreatInt

  • Photoview through 2.4.0 Authorization Bypass via shareAlbumPhotoview through ... — CVE ThreatInt

  • Hackers Exploiting F5 BIG-IP OAuth Server 0-day Flaw to Gain Remote Code Execution — Cyber Security News

  • ShinyHunters Allegedly Claims Breach of FBI Jobs Site and Stolen Agents’ Data — Cyber Security News

  • Cyber Resilience Act is here! Myth busting and first impressions — aikido.dev (discovered)

📋 ADVISORIES

  • 📄 Source for SQL injection flaw disclosed in SourceCodester Online Reviewer Management System 1.0 exam-delete.php — vuldb.com

🔓 CVEs & KEV

  • CVE-2026-93712 — CPANSec Dancer2 — CVSS 7.5 — Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside pu...

  • CVE-2026-93710 — CPANSec Dancer2 — CVSS 7.5 — Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dyi...

  • CVE-2026-93711 — CPANSec Dancer2 — CVSS 6.5 — Dancer2 versions before

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check