The vulnerability exists in the TypeDeserializerBase._findDeserializer() method of FasterXML jackson-databind. When name-based polymorphism is configured with a fallback (e.g., @JsonTypeInfo with defaultImpl), each distinct unrecognized type ID supplied by an attacker is cached as a separate key in the _deserializers map. This map has no size limit and persists for the lifetime of the type deserializer, causing memory to grow unbounded if many unique unknown type IDs are supplied. Exploitation requires an application that accepts attacker-controlled type IDs, uses name-based polymorphism with a fallback, and reuses a long-lived ObjectMapper. The fix prevents caching fallback deserializers for unrecognized IDs and limits the cache size and type ID length.

The vulnerability can cause uncontrolled memory consumption leading to denial of service (DoS) conditions. It does not affect confidentiality or integrity but impacts availability by exhausting memory resources when processing many distinct unknown type IDs. Exploitation requires specific application configurations and attacker control over type IDs.

A fix is available that stops caching fallback deserializers for unrecognized type IDs and bounds the cache size and type ID length. Users should upgrade to patched versions of jackson-databind that include this fix. No additional mitigation is indicated by the vendor advisory.