CVE-2026-68497

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.core:jackson-databind versions 2.0.0 through 2.18.9 com.fasterxml.jackson.core:jackson-databind versions 2.19.0 through 2.21.5 com.fasterxml.jackson.core:jackson-databind versions 2.22.0 through 2.22.1 tools.jackson.core:jackson-databind versions 3.0.0 through 3.1.5 tools.jackson.core:jackson-databind versions 3.2.0 through 3.2.1

Description An issue exists when binding a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field via the CoreXMLDeserializers.Std. deserialize function. The software passes the raw string directly to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value). Because the XML Schema lexical grammar allows numeric components of arbitrary length, the JDK uses BigInteger(String) and BigDecimal(String) constructors, which have quadratic complexity relative to the digit count. Since the input is treated as a JSON string rather than a JSON number, the StreamReadConstraints.maxNumberLength guard is bypassed, and the XML datatype deserializer fails to perform length validation. An unauthenticated attacker can send a request containing a string with several million digits, causing excessive CPU consumption and potentially saturating server worker threads.

Recommendations Update com.fasterxml.jackson.core:jackson-databind to version 2.18.10 Update com.fasterxml.jackson.core:jackson-databind to version 2.21.6 Update com.fasterxml.jackson.core:jackson-databind to version 2.22.2 Update tools.jackson.core:jackson-databind to version 3.1.6 Update tools.jackson.core:jackson-databind to version 3.2.2