Detections
Analytics

SCA: security update for com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind (GHSA-cxp5-3px4-pw24)

high Tenable Self-Hosted Container Security Plugin ID 450406

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a
 linear scan of the pending-reference accumulator for every resolved ID. The affected paths are
 CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent
 implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an
 identity-enabled collection or map and then defines those same IDs in reverse order, completion performs
 on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly
 causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class
 and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference
 lookup path for an equally sized control in which every reference was already resolved. The input requires
 no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes
 attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear
 lookup with a keyed pending-reference structure. (CVE-2026-91777)

Solution

Update the com.fasterxml.jackson.core:jackson-databind library and its related packages to version 2.18.11 or later.

See Also

https://github.com/advisories/GHSA-cxp5-3px4-pw24

Plugin Details

Severity: High

ID: 450406

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 9/30/2026

Updated: 9/30/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.63

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 5.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-91777

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/30/2026

Vulnerability Publication Date: 9/23/2026

Reference Information

CVE: CVE-2026-91777

cwe: CWE-400