The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a     linear scan of the pending-reference accumulator for every resolved ID. The affected paths are     CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent     implementation in MapDeserializer. When a document first creates N unresolved object-ID references in an     identity-enabled collection or map and then defines those same IDs in reverse order, completion performs     on the order of N * (N + 1) / 2 identity comparisons, so a shallow document whose size grows linearly     causes quadratic CPU work during deserialization. The reporter instrumented equals() calls on the ID class     and measured exactly 2,003,000 comparisons at N = 2,000, against zero comparisons in the pending-reference     lookup path for an equally sized control in which every reference was already resolved. The input requires     no deep nesting and no syntactically unusual JSON. Exploitation requires an application that deserializes     attacker-influenced JSON into an identity-enabled collection or map. The fix replaces the repeated linear     lookup with a keyed pending-reference structure. (CVE-2026-91777)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-91777

high Nessus Plugin ID 349504

Version 1.7