FasterXML jackson-databind Algorithmic Complexity DoS

Memory exhaustion in FasterXML jackson-databind allows unauthenticated remote attackers to grow an internal deserializer cache without bound by submitting JSON payloads that carry ever-changing, unrecognized polymorphic type IDs. TypeDeserializerBase caches each fallback resolution keyed by the raw attacker-supplied ID string, the map has no configurable size limit, and it lives for the lifetime of the long-lived ObjectMapper, so distinct unknown IDs translate directly into permanently retained heap - the reporter measured 10,000 retained entries from 10,000 distinct unknown IDs versus a single entry for 10,000 repetitions of one unknown ID. Exploitation requires a non-default configuration (name-based polymorphism via @JsonTypeInfo(use = Id.NAME) with a defaultImpl/fallback deserializer, an endpoint that accepts attacker-influenced type IDs, and a shared application-scoped mapper), so the affected population is substantially narrower than the 7.5 base score suggests; no public exploit has been identified at time of analysis and a vendor patch is available.

Denial of service in FasterXML jackson-databind allows unauthenticated remote attackers to exhaust CPU resources by submitting crafted JSON that triggers quadratic complexity in forward-reference resolution for @JsonIdentityInfo object IDs. The attack requires the application to deserialize attacker-influenced JSON into a collection or map configured with @JsonIdentityInfo; a shallow document with N forward references defined in reverse order causes O(N^2) identity comparisons during deserialization. This is a conditional availability risk-only applications using identity-enabled deserialization on untrusted input are exposed-and no public exploit code has been identified at time of analysis, though a vendor patch is available.