EUVD-2026-85002Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable, unauthenticated, low-complexity repeated requests exhaust heap memory; only availability is affected, so C:N/I:N/A:H, matching the vendor score.
Primary rating from Vendor (HeroDevs).
CVSS VectorVendor: HeroDevs
Lifecycle Timeline
4DescriptionCVE.org
TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied type ID. When name-based polymorphism is configured with a fallback, for example @JsonTypeInfo(use = Id.NAME, defaultImpl = ...), every distinct unrecognized type ID resolves to the same fallback deserializer but is retained as its own key in the _deserializers map. That map has no configurable bound and lives for the lifetime of the type deserializer, so an attacker who can repeatedly supply fresh unknown type IDs causes monotonic memory retention across requests. The reporter observed 10,000 retained entries from 10,000 distinct unknown IDs, against a single entry for a control that repeated one unknown ID the same number of times, isolating attacker-controlled key cardinality from request volume. Exploitation requires an application that enables name-based polymorphism with a defaultImpl or equivalent fallback, accepts attacker-influenced type IDs, and reuses a long-lived ObjectMapper across requests. The fix stops caching fallback resolutions for unrecognized IDs and bounds both the number of cached entries and the length of a cacheable type ID.
Articles & Coverage 1
AnalysisAI
Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a specific, non-default application configuration: name-based polymorphic type handling enabled via @JsonTypeInfo(use=Id.NAME) (or equivalent) WITH a defaultImpl/fallback deserializer configured, an endpoint that accepts attacker-influenced type IDs in the JSON payload, AND reuse of a single long-lived ObjectMapper (thus a persistent TypeDeserializerBase) across requests. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a network-reachable, unauthenticated, low-complexity memory-exhaustion DoS with no confidentiality or integrity impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor patch availability is confirmed (patch available per vendor advisory), but no exact fixed version number is supplied in the provided data, so upgrade jackson-databind to the release identified in the vendor advisory GHSA-wv8q-qhhj-9h54 (upstream fix tracked at https://github.com/FasterXML/jackson-databind/issues/6203) and re-test the specific mapper configuration in use; the fix stops caching fallback resolutions for unrecognized IDs and bounds both the cached-entry count and the permissible type-ID length, so behavior for unknown IDs changes and should be re-validated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory Java applications using FasterXML jackson-databind and identify those that enable name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, accept attacker-influenced type IDs, and share an application-scoped ObjectMapper; Patch available per vendor advisory, so apply the vendor patch first to confirmed exposed or internet-facing services, and if immediate patching is not possible, disable the non-default fallback/defaultImpl configuration, restrict untrusted type IDs, and add heap/GC monitoring plus rate limiting. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today