TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1793620241 advisory.

  - jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes     inside its generic arguments, even when those classes violate the declared type or would be rejected as     direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512     (GHSA-j3rv-43j4-c7qm), of which this is an incomplete fix. DatabindContext._resolveAndValidateGeneric()     checks the outer class against the declared base type and then passes each argument from the type ID to
    _validateTypeParameter(), which validates the argument against the outer base type rather than enforcing     its corresponding declared generic binding. It also invokes validators with arguments that have not passed     the subtype check those validators expect. Under the default DefaultBaseTypeLimitingValidator this accepts     an unrelated class inside a generic subtype even when the same class is rejected as a direct type ID.
    Where an allowIfBaseType(...) rule approves the outer type, Jackson substitutes     LaissezFaireSubTypeValidator, so the configured validator no longer restricts the embedded arguments. The     element type of a plain array type ID such as [Lpkg.Gadget; is likewise left unvalidated once the array's     base type is approved. Affected paths include annotation-based class-name polymorphism with a default     Jackson 3.x JsonMapper, configured default typing in both Jackson 2.x and 3.x, and integrations that     expose that default typing. The default-validator case requires no application-authored validator: with     @JsonTypeInfo(use = Id.CLASS), a direct gadget type ID is rejected as Not a subtype, while a type ID     naming a generic wrapper around the same gadget is accepted and deserialized, including attacker-supplied     bean properties. Where class-name default typing permits Map, a property declared as Map<String,String>     accepts HashMap<FileSystemXmlApplicationContext,String>; map-key discovery then passes the attacker-     controlled JSON property name to the selected class's one-string constructor. With Spring on the classpath     and attacker-controlled XML the application can load, that constructor loads the XML and invokes     ProcessBuilder.start() under the application account, giving arbitrary command execution. This issue     affects com.fasterxml.jackson.core:jackson-databind from 2.10.0 and tools.jackson.core:jackson-databind     from 3.0.0. Releases before 2.10.0 are not affected, because PolymorphicTypeValidator was introduced in     jackson-databind 2.10.0. (CVE-2026-110879)

  - TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer     under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for     example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to     the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no     configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly     supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed     10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that     repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from     request volume. Exploitation requires an application that enables name-based polymorphism with a     defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived     ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds     both the number of cached entries and the length of a cacheable type ID. (CVE-2026-91776)

  - Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a     linear scan of the pending-reference accumulator for every resolved ID. The affected paths are     CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent     implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an     identity-enabled collection or map and then defines those same IDs in reverse order, completion performs     on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly     causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class     and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference     lookup path for an equally sized control in which every reference was already resolved. The input requires     no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes     attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear     lookup with a keyed pending-reference structure. (CVE-2026-91777)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3305 advisory.

    jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without     restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from     untrusted JSON is passed to new URI(value) and then to Path.of(uri). When that throws     FileSystemNotFoundException, the code enumerates ServiceLoader<FileSystemProvider> and calls     provider.getPath(uri) on the first provider whose scheme matches the attacker-chosen scheme. Untrusted     JSON can therefore select and drive an arbitrary registered FileSystemProvider during readValue under a     default JsonMapper, and forces provider class loading at the same time. With only the JDK built-in     providers (file, jar/zipfs) present, the resolved path is inert and no mount or network I/O occurs;
    further impact requires a side-effecting third-party FileSystemProvider on the classpath. This affects     com.fasterxml.jackson.core:jackson-databind from 2.8.0 before 2.18.10, from 2.19.0 before 2.21.6, and from     2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. Binding java.nio.file.Path     from untrusted JSON should be avoided regardless of version. (CVE-2026-19032)

    jackson-databind binds a JSON string to a javax.xml.datatype.Duration or     javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to     DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in     CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a     plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this     path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK     materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in     digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-     core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call     validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype     deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a     few megabytes, such as a Duration value consisting of the letter P followed by several million digits and     the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of     concurrent requests can saturate a server's worker threads. This affects     com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from     2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-68497)

    DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever     @JsonTypeInfo is used without an explicitly configured custom validator. It denies polymorphic resolution     only for a fixed set of unsafe base types, and its isSafeSubType method returns true unconditionally for     every base type outside that set. java.lang.Comparable was absent from the list despite being implemented     by a very large fraction of JDK and application classes, comparable in breadth to java.io.Serializable,     which is on the list for that reason. An application declaring an @JsonTypeInfo-annotated property or     class with Comparable as its base type, and no custom PolymorphicTypeValidator, will accept a type     identifier for essentially any class implementing Comparable. This yields an attacker-controlled object     instantiation primitive; a demonstrated case constructs a java.io.File for an arbitrary attacker-chosen     path, which becomes path-traversal-adjacent if the application subsequently calls path-sensitive methods     on the value. No class implementing Comparable has been identified that yields code execution through     deserialization alone. Global Default Typing via activateDefaultTyping is not affected, because that     method structurally requires an explicit PolymorphicTypeValidator argument. This affects     com.fasterxml.jackson.core:jackson-databind from 2.11.0 before 2.18.10, from 2.19.0 before 2.21.6, and     from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-83557)

    TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer     under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for     example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to     the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no     configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly     supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed     10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that     repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from     request volume. Exploitation requires an application that enables name-based polymorphism with a     defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived     ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds     both the number of cached entries and the length of a cacheable type ID. (CVE-2026-91776)

    Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a     linear scan of the pending-reference accumulator for every resolved ID. The affected paths are     CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent     implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an     identity-enabled collection or map and then defines those same IDs in reverse order, completion performs     on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly     causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class     and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference     lookup path for an equally sized control in which every reference was already resolved. The input requires     no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes     attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear     lookup with a keyed pending-reference structure. (CVE-2026-91777)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7b3ea5d6-cf3d-11f1-a655-3497f65b111b advisory.

    The Jackson project reports:
    CVE-2026-91776: TypeDeserializerBase caches the resolved                 deserializer under the raw, attacker supplied type id. With name                 based polymorphism and a fallback, every unrecognized type id adds                 an entry and the cache grows without bound.
    CVE-2026-91777: forward reference completion for JsonIdentityInfo                 object ids scans the pending reference accumulator for every                 resolved id, which is quadratic in the number of references.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory.

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Document     Management (Spring Framework)). Supported versions that are affected are 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera     Unifier accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of     Primavera Unifier. (CVE-2026-22735, CVE-2026-22741, CVE-2026-22745, CVE-2026-41838, CVE-2026-41839,     CVE-2026-41840, CVE-2026-41841, CVE-2026-41842, CVE-2026-41843, CVE-2026-41844, CVE-2026-41845,     CVE-2026-41846, CVE-2026-41848, CVE-2026-41850, CVE-2026-41851, CVE-2026-41852, CVE-2026-41854,     CVE-2026-41855)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (jsoup)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15, 23.12.0-23.12.16,     24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Primavera Unifier. Successful attacks of this vulnerability can     result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Primavera     Unifier. (CVE-2026-75140)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Platform     (jackson-databind)). Supported versions that are affected are 21.12.0-21.12.17, 22.12.0-22.12.15,     23.12.0-23.12.16, 24.12.0-24.12.16 and 25.12.0-25.12.9. Easily exploitable vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash     (complete DOS) of Primavera Unifier. (CVE-2026-19032, CVE-2026-68497, CVE-2026-91777)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Core).
    Supported versions that are affected are 21.12.0-21.12.17. Difficult to exploit vulnerability allows     unauthenticated attacker with network access via HTTP to compromise Primavera Unifier. Successful attacks     of this vulnerability can result in unauthorized creation, deletion or modification access to critical     data or all Primavera Unifier accessible data as well as unauthorized access to critical data or complete     access to all Primavera Unifier accessible data. (CVE-2026-101736)

  - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering (component: Project     Control). Supported versions that are affected are 23.12.0-23.12.16. Easily exploitable vulnerability     allows low privileged attacker with network access via HTTP to compromise Primavera Unifier. Successful     attacks of this vulnerability can result in unauthorized creation, deletion or modification access to     critical data or all Primavera Unifier accessible data as well as unauthorized read access to a subset of     Primavera Unifier accessible data. (CVE-2026-101735)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22034-1 advisory.

    - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time     Issues       (bsc#1273856).
    - CVE-2026-19032: deserializer for `java.nio.file.Path` resolves attacker-supplied URIs without     restricting the URI       scheme (bsc#1277883).
    - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
    - CVE-2026-68497: An unauthenticated attacker can therefore submit a single request of a few megabytes     (bsc#1280125).
    - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
    - CVE-2026-83557: incomplete `PolymorphicTypeValidator` denylist allows for arbitrary `Comparable`     deserialization       (bsc#1278008).
    - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
    - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which     allows for       unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed     (bsc#1282505).
    - CVE-2026-91776: `TypeDeserializerBase._findDeserializer()` caches the resolved deserializer under the     raw, attacker-       supplied type ID, which can lead to unbounded cache growth under certain configurations (bsc#1282491).
    - CVE-2026-91777: forward-reference completion for `@JsonIdentityInfo` object IDs performs a linear scan     of the pending-       reference accumulator for every resolved ID, which can lead to quadratic CPU work during deserialization       (bsc#1282492).

    Changes for jackson-annotations:

    - Update to 2.18.11

    Changes for jackson-core:

    - Update to 2.18.11
     * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,      CVE-2026-89407)
     * #1698: UTF8DataInputJsonParser does not honor      maxErrorTokenLength when reporting an unrecognized token      (bsc#1282505, CVE-2026-89425)
     * #1642: Fix maxDocumentLength bypass in async parser      single-feedInput() case [GHSA-2c4j-63jj-9fqr]
     * #1643: Enforce maxNameLength incrementally in      ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)      of async parser (bsc#1273857, CVE-2026-68494)      non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

    Changes for jackson-databind:

    - Update to 2.18.11
     * #6185: Bracket unresolved IPv6 host name in InetSocketAddress      serialization
     * #6203: Prevent unbounded growth of type id cache in      TypeDeserializer (bsc#1282491, CVE-2026-91776)
     * #6204: Avoid quadratic forward-reference resolution in      Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
     * #6099: Resolve classes without initialization in      TypeFactory.findClass()
     * #6116: Reject non-ASCII digits in InetAddress literal validation
     * #6127: Add StreamReadConstraints number len constraint to      javax.xml.datatype.XMLGregorianCalendar and      javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
     * #6129: Limit the supported URL schemes for java.nio.file.Path      deserialization (bsc#1277883, CVE-2026-19032)
     * #6156: Add java.lang.Comparable in set of unsafe polymorphic      base types (bsc#1278008, CVE-2026-83557)
     * #6165: Apply number length limits to BigDecimal/BigInteger/      /Double/Float Map keys

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer
    under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for
    example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to
    the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no
    configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly
    supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed
    10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that
    repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from
    request volume. Exploitation requires an application that enables name-based polymorphism with a
    defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived
    ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds
    both the number of cached entries and the length of a cacheable type ID. (CVE-2026-91776)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4394-1 advisory.

    - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time     Issues       (bsc#1273856).
    - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
    - CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
    - CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
    - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
    - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
    - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which     allows for       unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed     (bsc#1282505).

    Changes for jackson-annotations:

    - Update to 2.18.11

    Changes for jackson-bom:

    - Update to 2.18.11

    Changes for jackson-core:

    - Update to 2.18.11
     * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,      CVE-2026-89407)
     * #1698: UTF8DataInputJsonParser does not honor      maxErrorTokenLength when reporting an unrecognized token      (bsc#1282505, CVE-2026-89425)
     * #1642: Fix maxDocumentLength bypass in async parser      single-feedInput() case [GHSA-2c4j-63jj-9fqr]
     * #1643: Enforce maxNameLength incrementally in      ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)      of async parser (bsc#1273857, CVE-2026-68494)      non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

    Changes for jackson-databind:

    - Update to 2.18.11
     * #6185: Bracket unresolved IPv6 host name in InetSocketAddress      serialization
     * #6203: Prevent unbounded growth of type id cache in      TypeDeserializer (bsc#1282491, CVE-2026-91776)
     * #6204: Avoid quadratic forward-reference resolution in      Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
     * #6099: Resolve classes without initialization in      TypeFactory.findClass()
     * #6116: Reject non-ASCII digits in InetAddress literal validation
     * #6127: Add StreamReadConstraints number len constraint to      javax.xml.datatype.XMLGregorianCalendar and      javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
     * #6129: Limit the supported URL schemes for java.nio.file.Path      deserialization (bsc#1277883, CVE-2026-19032)
     * #6156: Add java.lang.Comparable in set of unsafe polymorphic      base types (bsc#1278008, CVE-2026-83557)
     * #6165: Apply number length limits to BigDecimal/BigInteger/      /Double/Float Map keys

    Changes for jackson-dataformat-xml:

    - Update to 2.18.11
     * Fix build to avoid past-JDK-8 bytecode generation
     * #891: Enforce StreamReadConstraints.maxNestingDepth in      FromXmlParser

    Changes for jackson-dataformats-binary:

    - Update to 2.18.11
     * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength      in ProtobufParser
     * #785: (avro) Support StreamReadConstraints.maxDocumentLength and      maxTokenCount in Avro parser
     * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion      parser (partial fix for #358)
     * #805: (ion) Support StreamReadConstraints.maxDocumentLength in      Ion parser (partial fix for #358)
     * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser      (bsc#1282639, CVE-2026-68495)
     * #726: (smile) Ensure maxNameLength limit enforced for Smile      parser (bsc#1282640, CVE-2026-68496)
     * #727: (cbor) CBORParser.nextFieldName(SerializableString)      confuses 5-bit length marker 23 with 24 ('1-byte length suffix      follows')
     * #728: (cbor) CBORParser.nextFieldName(SerializableString)      consumes Object entry slot twice on fast-path miss, truncating      definite-length Objects
     * #733: (cbor) Long `String`s not added to 'stringref' reference      table, breaking following references
     * #735: (cbor) 'stringref' property-name paths pass 5-bit length      marker instead of actual length to shouldReferenceString()
     * #736: (cbor) Long Object property names added to 'stringref'      reference table twice

    Changes for jackson-modules-base:

    - Update to 2.18.11

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer     under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for     example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to     the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no     configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly     supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed     10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that     repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from     request volume. Exploitation requires an application that enables name-based polymorphism with a     defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived     ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds     both the number of cached entries and the length of a cacheable type ID. (CVE-2026-91776)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
375163	AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1793620241)	Nessus	Alma Linux Local Security Checks	Local	critical
371831	Amazon Linux 2023 : jackson-databind (ALAS2023-2026-3305)	Nessus	Amazon Linux Local Security Checks	Local	medium
370452	FreeBSD : jackson-databind -- denial of service (7b3ea5d6-cf3d-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high
370446	Oracle Primavera Unifier (October 2026 CPU)	Nessus	CGI abuses	Remote	high
364341	openSUSE 16: jackson-annotations / jackson-annotations-javadoc / jackson-core / etc (openSUSE-SU-2026:22034-1)	Nessus	SuSE Local Security Checks	Local	high
459175	Echo: com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind: security update to 2.18.11	Tenable Cloud Security	Echo Local Security Checks	Local	high
459175	Echo: com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind: security update to 2.18.11	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351412	SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:4394-1)	Nessus	SuSE Local Security Checks	Local	high
349507	Linux Distros Unpatched Vulnerability : CVE-2026-91776	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-91776

high

Tenable Plugins

Coming Soon

critical

medium

high

high

high

high

high

high

high