Jackson's September 2026 Advisories: One Hits Default Mappers

On 22 September 2026 the FasterXML project published four advisories for jackson-databind and jackson-core, after shipping fixed releases on 20 and 21 September. All four are denial of service issues rated High in the GitHub Advisory Database, which added them on 30 September and 1 October.

Jackson sits under most Java web stacks, so these show up in nearly every JVM scan. The interesting part is that three of the four need a feature most apps don't use. The fourth reaches ordinary request binding.

What's affected

Fixed versions for all four are 2.18.11, 2.21.7 and 2.22.3 on the 2.x lines and 3.1.7 and 3.2.3 on Jackson 3 (tools.jackson.core). Every 2.x release before those patch levels is affected by at least one of them.

CVE-2026-89407 is a regular expression problem in NumberInput.looksLikeValidNumber(). The float pattern backtracks quadratically on a long run of digits that doesn't end as a valid number. The advisory measured a single 160,000 character string taking 74.4 seconds in one call. Its impact section says any application that coerces a String-typed JSON field to a number, which jackson-databind does by default, is exposed. Send "age": "111...1x" to an endpoint with an int age field and the coercion path runs the regex. Affected jackson-core lines start at 2.17.0; on 3.2 the fix is 3.2.2.

CVE-2026-91777 affects forward-reference resolution for @JsonIdentityInfo. A collection that references N object IDs and then defines them in reverse order makes databind do quadratic work. The advisory says the app must deserialize attacker-influenced JSON into an identity-enabled collection or map.

CVE-2026-91776 is unbounded cache growth. With name-based polymorphism and a fallback defaultImpl, every unknown type ID an attacker sends becomes a new key in a process-lifetime map.

CVE-2026-89425 affects only the DataInput parser, which skipped the maxErrorTokenLength limit when building an error message. A 20 million character malformed token produced a 20 million character exception message. Parsers created from InputStream, Reader, String or byte[] are bounded correctly.

Earlier advisories, fixed one patch level lower (2.18.10, 2.21.6, 2.22.2), add more of the same pattern. CVE-2026-68497 is the other one that hits default mappers: any field typed javax.xml.datatype.Duration or XMLGregorianCalendar parses an unbounded digit string. CVE-2026-19032 needs a java.nio.file.Path field bound from JSON, and CVE-2026-83557 needs @JsonTypeInfo on a Comparable-typed property with no custom validator.

How to check if you're exposed

Find the resolved versions. Spring Boot and other BOMs often pin Jackson for you:

mvn -q dependency:tree -Dincludes=com.fasterxml.jackson.core
./gradlew dependencyInsight --dependency jackson-databind --configuration runtimeClasspath

Then search your code for the features that gate each issue:

grep -rn "@JsonIdentityInfo" src/
grep -rn "@JsonTypeInfo" src/ | grep -i "defaultImpl"
grep -rn "createParser(.*DataInput\|readValue(.*DataInput" src/
grep -rln "javax.xml.datatype" src/

For CVE-2026-89407, assume you're reachable if any public endpoint binds JSON into numeric fields. That is almost every REST API. You can confirm the coercion setting: unless you've disabled MapperFeature.ALLOW_COERCION_OF_SCALARS or configured coercion to fail for strings, a quoted number is coerced.

What to do now

1. Upgrade jackson-core and jackson-databind together to 2.18.11, 2.21.7 or 2.22.3, or to 3.1.7 or 3.2.3 on Jackson 3. Keep every Jackson module on the same version.
2. Override the BOM if your framework pins an older version. In Spring Boot 3 builds, set the jackson-bom.version property rather than adding individual Jackson dependencies.
3. Cap request body size at the edge. The NumberInput issue needs tens to hundreds of kilobytes per request to hurt. A body limit on your gateway or servlet container shrinks the window.
4. Lower StreamReadConstraints.maxStringLength if your APIs never need multi-megabyte strings. The advisory points out the default is far larger than any numeric field needs.
5. Rebuild and redeploy container images. Jackson is usually bundled inside fat JARs, so the fix only lands when the artifact is rebuilt.

Why it matters

Jackson advisories tend to arrive in batches, and the default reaction is to treat every one as equally urgent. That wastes effort in one direction and underestimates risk in the other. The annotation-gated bugs only matter for the few services that use those annotations on untrusted input. The coercion bug sits on the path every JSON request takes.

Reachability gets you to the right order: patch the services where a plain numeric field faces the internet first, and schedule the rest with your next dependency refresh.

Try it yourself

Generate a CycloneDX SBOM for one service with mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom, which writes target/bom.json. Load it into the free scan at gold.safeguard.sh/scan, which runs in your browser and keeps the file on your machine. Then run the four grep commands above and mark which advisories your code can actually reach.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GHSA-p6pp-m3f8-5c89: jackson-core NumberInput ReDoS
• GHSA-7hhh-6rmp-j9qf: jackson-core DataInput error token growth
• GHSA-cxp5-3px4-pw24: jackson-databind forward-reference completion
• GHSA-wv8q-qhhj-9h54: jackson-databind unknown type ID retention
• GHSA-q4xh-88c3-wmh7: Duration and XMLGregorianCalendar parse DoS
• jackson-databind 2.18.11 release
• Maven Central: jackson-databind versions