CVE-2026-68497
Received Received - Intake

Denial of Service in Jackson Databind

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: HeroDevs

Description
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-68497
EUVD
EUVD-2026-76142

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
fasterxml jackson-databind to 2.18.10 (exc)
fasterxml jackson-databind to 2.21.6 (exc)
fasterxml jackson-databind to 2.22.2 (exc)
fasterxml jackson-databind to 3.1.6 (exc)
fasterxml jackson-databind to 3.2.2 (exc)
fasterxml jackson-databind 2.18.10
fasterxml jackson-databind 2.21.6
fasterxml jackson-databind 2.22.2
fasterxml jackson-databind 3.1.6
fasterxml jackson-databind 3.2.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-68497 is a denial-of-service vulnerability in jackson-databind where JSON strings are deserialized into javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields. The raw string is passed to JDK methods that parse numeric components using inefficient O(n²) algorithms. Attackers can send small payloads (1-5 MB) that force excessive CPU usage, saturating server resources.

Detection Guidance

Monitor for unusually high CPU usage or slow responses when processing JSON payloads containing Duration or XMLGregorianCalendar fields. Check logs for requests with very long numeric strings (e.g., P followed by millions of digits). Use network traffic analysis tools to detect large JSON payloads (1-5 MB) with these patterns.

Impact Analysis

This vulnerability allows unauthenticated attackers to disrupt service availability by sending crafted JSON requests. A few concurrent requests can consume all server CPU and memory, leading to slowdowns or crashes. Systems using default jackson-databind configurations without polymorphic typing are most affected.

Mitigation Strategies

Upgrade jackson-databind to version 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 or later. If upgrading is not immediately possible, implement input validation to limit JSON string lengths before deserialization. Configure StreamReadConstraints to enforce maximum number length limits.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68497. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart