CLEANSTART-2026-SQ73698: Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID
CVE-2026-91777 affects multiple packages. Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference accumulator for every resolved ID. See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r0 - Upgrade
Upgrade
cleanstart/sonarqubeto a version that resolves this vulnerability.Fixed in 26.10.0.133078-r1 - Upgrade
Upgrade
cleanstart/strimzi-kafka-operatorto a version that resolves this vulnerability.Fixed in 1.3.0-r0
Event History
Frequently Asked Questions
Which listed deployments should be prioritized for triage?
The affected software list includes cleanstart/sonarqube and cleanstart/strimzi-kafka-operator. The advisory does not provide affected version ranges for either package.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required. The stated impact is availability only; confidentiality and integrity impacts are listed as none.
Can this data confirm whether a specific deployment is affected?
No. The data identifies the CVE and listed packages, but does not include package versions, dependency versions, configuration details, or detection indicators needed to confirm exposure in an individual deployment.