fix(deps): update dependency tools.jackson.core:jackson-databind to v3.2.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
tools.jackson.core:jackson-databind (source)	3.2.2 → 3.2.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

jackson-databind retains every unknown raw type ID

CVE-2026-91776 / GHSA-wv8q-qhhj-9h54

More information

Details

Summary

With @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unknown
raw type ID selects the same fallback deserializer but is retained as a
separate key in TypeDeserializerBase._deserializers. An attacker who can
repeatedly supply new unknown type IDs can grow this process-lifetime cache
without a configured bound.

Details

The affected path is TypeDeserializerBase._findDeserializer(). After an
unknown name-based type ID resolves to the configured fallback/default
implementation, jackson-databind caches the result under the attacker-provided
raw typeId. Although all such IDs select the same fallback deserializer, each
new string remains a distinct cache key.

The behavior is runtime-confirmed in jackson-databind 2.22.1 and 3.2.1.
Current 2.22 and 3.2 source branches retained the unbounded _deserializers
map and per-raw-ID cache write when rechecked. The earlier affected floor has
not been established, patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.

The vulnerable application must enable name-based polymorphism with a
defaultImpl or equivalent fallback, accept attacker-influenced type IDs, and
reuse a long-lived mapper/type deserializer across requests.

Suggested correction: avoid caching each unknown raw ID when every such ID
resolves to the same fallback, use a fallback sentinel, or use an explicitly
bounded concurrency-safe cache. A regression should contrast many distinct
unknown IDs with repetitions of one unknown ID across requests.

PoC

Configure a polymorphic base type with
@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, defaultImpl = Fallback.class) and
deserialize inputs containing unknown type names through the same mapper.
Inspect TypeDeserializerBase._deserializers after the run.

On affected 2.x and 3.x versions, 10,000 distinct unknown raw type IDs produce
10,000 retained cache entries even though every input selects the same
fallback deserializer. A matched control that repeats one unknown ID 10,000
times produces one retained entry. This isolates attacker-controlled key
cardinality from ordinary request count.

Impact

Where the stated polymorphic fallback configuration is exposed to
attacker-influenced type IDs, distinct inputs cause incremental
process-lifetime memory retention and eventual availability pressure or
denial of service. This is not claimed as a single-request allocation spike,
and no fixed bytes-per-ID or time-to-out-of-memory value is asserted. No
confidentiality, integrity, or code-execution impact is claimed.

Requested credit: Daniel Birtwhistle

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-wv8q-qhhj-9h54
• https://nvd.nist.gov/vuln/detail/CVE-2026-91776
• https://github.com/FasterXML/jackson-databind/issues/6203
• https://github.com/FasterXML/jackson-databind/commit/2870d1d6dc1b7e1c07ee11dd5b04ab71cddbb577
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3
• https://github.com/advisories/GHSA-wv8q-qhhj-9h54

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

jackson-databind quadratic forward-reference completion

CVE-2026-91777 / GHSA-cxp5-3px4-pw24

More information

Details

Summary

When an @JsonIdentityInfo collection or map first creates N unresolved
object-ID references and later resolves the same IDs in reverse order,
jackson-databind scans the remaining pending-reference accumulator for each
resolution. A shallow JSON document whose size grows linearly can therefore
cause quadratic CPU work during deserialization.

Details

The affected path is forward-reference completion in
CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference()
and the corresponding map implementation. The implementation performs a
linear search of the pending accumulator for every resolved object ID.

The behavior is runtime-confirmed in jackson-databind 2.5.0, 2.22.1, and
3.2.1. Current 2.22 and 3.2 source branches retained the same design when
rechecked. A 2.4.0 control fails closed before successful reverse-order
completion, so 2.5.0 is the conservative runtime-confirmed affected floor.
The patched versions are: 2.18.11, 2.21.7, 2.22.3, 3.1.7 and 3.2.3.

The vulnerable application must deserialize attacker-influenced JSON into an
identity-enabled collection or map. The issue does not require deep nesting or
syntactically unusual JSON.

Suggested correction: replace repeated linear lookup/removal with a keyed
pending-reference structure or another design that provides linear or
amortized-linear completion. A regression should preserve input order,
duplicate-ID behavior, and unresolved-ID errors while bounding reverse-order
resolution work.

PoC

The proof constructs a shallow collection containing N unresolved
@JsonIdentityInfo references followed by definitions of those same IDs in
reverse order. Its ID class counts equals() calls, giving a deterministic
work measure rather than a timing-dependent result.

With N=2,000, affected versions perform exactly 2,003,000 ID comparisons. An
equally sized control in which every reference is already resolved performs
zero comparisons in the pending-reference lookup path. The run is bounded to
a 512 MiB JVM. The result demonstrates quadratic growth: approximately
N * (N + 1) / 2 comparisons, plus fixed setup comparisons.

Impact

An unauthenticated source that can submit JSON to an application using the
affected identity-enabled collection or map shape can consume quadratic CPU
and exhaust a request-time or worker-capacity budget, causing denial of
service. The application model/configuration prerequisite is material. No
confidentiality, integrity, code-execution, or parser-depth impact is claimed.

Requested credit: Daniel Birtwhistle

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-cxp5-3px4-pw24
• https://nvd.nist.gov/vuln/detail/CVE-2026-91777
• https://github.com/FasterXML/jackson-databind/issues/6204
• https://github.com/FasterXML/jackson-databind/pull/6204
• https://github.com/FasterXML/jackson-databind/commit/37ad9b81712cbb9fb62c2d2c1813593252a24b67
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.11
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.7
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.3
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.7
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.3
• https://github.com/advisories/GHSA-cxp5-3px4-pw24

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.