vulnerability · Wed 23 Sep 2026 · 03:17 UTC

CVE-2026-91777: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML

Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. The affected paths are CollectionDeserializer.CollectionReferringAccumulator.resolveForwardReference() and the equivalent implementation in MapDeserializer. …

Signals

as the pipeline stamped them

High: High-risk vulnerability — CVSS 7.5

CVE

KEV from CISA · EPSS from FIRST

CVE ids in this dispatch with their KEV status and EPSS score
Id	KEV	EPSS	Reference
CVE-2026-91777	—	0.45%	NVD ↗

Get the next one first.

Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.