Detections
Analytics

Echo: com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind: security update to 2.18.11

high Tenable Cloud Security Plugin ID 459175

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer
 under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for
 example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to
 the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no
 configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly
 supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed
 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that
 repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from
 request volume. Exploitation requires an application that enables name-based polymorphism with a
 defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived
 ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds
 both the number of cached entries and the length of a cacheable type ID. (CVE-2026-91776)

Solution

Update the com.fasterxml.jackson.core:jackson-databind library and its related packages to version 2.18.11 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-91776

Plugin Details

Severity: High

ID: 459175

Version: Revision 1.3

Type: Local

Published: 10/2/2026

Updated: 10/13/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.18

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-91776

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/1/2026

Vulnerability Publication Date: 9/23/2026

Reference Information

CVE: CVE-2026-91776