CLEANSTART-2026-OE47694: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Q: What application behavior reaches the affected code path?

The issue is triggered during forward-reference completion for object IDs handled with @JsonIdentityInfo. The affected operation scans the pending-reference accumulator once for each resolved ID.

Q: What does an attacker need to supply to exploit this behavior?

The available information indicates that exploitation depends on input that causes @JsonIdentityInfo object-ID forward references to be completed. No further attacker prerequisites are provided.

Q: Are affected versions or an immediate mitigation identified?

No affected version range, fixed version, or workaround is provided in the available advisory data.

Published Nov 8, 2026

Updated

Security vulnerability affects the gradle package. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID.

Affected Software

1 affected componentFixes available

cleanstart/gradle<9.8.2-r0

9.8.2-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/gradle to a version that resolves this vulnerability.
Fixed in 9.8.2-r0

Event History

Nov 8, 2026

Advisory Published

via OSV·12:37 AM

Data Sourced

via OSV·12:37 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-91777

Frequently Asked Questions

What application behavior reaches the affected code path?

The issue is triggered during forward-reference completion for object IDs handled with @JsonIdentityInfo. The affected operation scans the pending-reference accumulator once for each resolved ID.

What does an attacker need to supply to exploit this behavior?

The available information indicates that exploitation depends on input that causes @JsonIdentityInfo object-ID forward references to be completed. No further attacker prerequisites are provided.

Are affected versions or an immediate mitigation identified?

No affected version range, fixed version, or workaround is provided in the available advisory data.

CLEANSTART-2026-OE47694: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What application behavior reaches the affected code path?

What does an attacker need to supply to exploit this behavior?

Are affected versions or an immediate mitigation identified?

Company

Resources

Contact

Frequently Asked Questions

What application behavior reaches the affected code path?

What does an attacker need to supply to exploit this behavior?

Are affected versions or an immediate mitigation identified?