CVE-2026-68497

Overview

jackson-databind is the general-purpose data-binding package of the FasterXML Jackson suite. It provides full data-binding (object serialization and deserialization) on top of the Jackson streaming parser/generator (jackson-core) and the Jackson annotations (jackson-annotations), and is one of the most widely used JSON libraries for Java.

A denial of service vulnerability (CVE-2026-68497) has been identified in jackson-databind, which allows attackers who control a JSON string bound to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar value to force the parsing of an arbitrarily large number. The raw string is handed to the JDK datatype factory with no length limit, so a single small request drives a super-linear parse that consumes tens of seconds to minutes of single-thread CPU.

Per CWE-400, Uncontrolled Resource Consumption, this weakness class describes a product that does not properly control the allocation and maintenance of a limited resource.

This issue affects multiple versions of jackson-databind: 2.x releases from 2.0.0 up to and including 2.18.9, from 2.19.0 up to and including 2.21.5, and from 2.22.0 up to and including 2.22.1, as well as 3.x releases prior to 3.1.6 and 3.2.x releases prior to 3.2.2.

Details

Module Info

• Product: jackson-databind
• Affected packages: com.fasterxml.jackson.core:jackson-databind (2.x), tools.jackson.core:jackson-databind (3.x)
• Affected versions: com.fasterxml.jackson.core:jackson-databind: >=2.0.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2; tools.jackson.core:jackson-databind: >=3.0.0 <3.1.6, >=3.2.0 <3.2.2
• GitHub repository: https://github.com/FasterXML/jackson-databind
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.core/jackson-databind
• Package manager: Maven
• Fixed in:
  
  • NES for Jackson 2.13.11, 2.14.8, and 2.15.9
  • OSS Jackson 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2

Vulnerability Info

This High-severity vulnerability is found in the com.fasterxml.jackson.core:jackson-databind package in multiple 2.x and 3.x versions of jackson-databind. The default deserializer for javax.xml.datatype.Duration and javax.xml.datatype.XMLGregorianCalendar (CoreXMLDeserializers.Std on the 2.x lines) passes the raw JSON string straight to DatatypeFactory.newDuration(value) and DatatypeFactory.newXMLGregorianCalendar(value) with no bound on its length:

protected Object _deserialize(String value, DeserializationContext ctxt)
    throws IOException
{
    switch (_kind) {
    case TYPE_DURATION:
        return _dataTypeFactory.newDuration(value);
    case TYPE_QNAME:
        return QName.valueOf(value);
    case TYPE_G_CALENDAR:
        Date d;
        try {
            d = _parseDate(value, ctxt);
        }
        catch (JsonMappingException e) {
            // try to parse from native XML Schema 1.0 lexical representation String,
            // which includes time-only formats not handled by parseXMLGregorianCalendarFromJacksonFormat(...)
            return _dataTypeFactory.newXMLGregorianCalendar(value);
        }
        return _gregorianFromDate(ctxt, d);
    }
    throw new IllegalStateException();
}

Per the XML Schema lexical grammar, newDuration parses each numeric component into a java.math.BigInteger and newXMLGregorianCalendar parses fractional seconds into a java.math.BigDecimal. The JDK builds these with the native BigInteger(String) / BigDecimal(String) constructors, which are O(n²) in the digit count, so a short JSON string such as "P" + "9"×N + "Y" forces the allocation and O(N²) parse of an N-digit number. Because these XML datatype deserializers are wired into Jackson's standard deserializer factory (findBeanDeserializer returns Std for both types unconditionally), a stock new ObjectMapper() with no polymorphic typing, no registered modules, and no other configuration is exposed; the only precondition is that the application binds a Duration- or XMLGregorianCalendar-typed value from untrusted JSON.

The jackson-core StreamReadConstraints.maxNumberLength guard (default 1000) does not close this path: it bounds the text length of JSON number tokens only, while the attacker's digits live inside a JSON string token, bounded only by maxStringLength (default 100,000,000 where that setting exists). jackson-databind applies the same length pre-check on its stringified-number path in NumberDeserializers, but the XML datatype path omits it, so a single unauthenticated request of a few megabytes can pin a CPU core for an extended period.

Steps to Reproduce

1. Put an affected jackson-databind release (for example 2.15.4) on the classpath of a small Java program.
2. Declare a bean with a javax.xml.datatype.Duration-typed property and deserialize an oversized lexical value with a default ObjectMapper:

public static class Cfg {
    public javax.xml.datatype.Duration ttl;
}

ObjectMapper mapper = new ObjectMapper();

// Baseline: a normal value parses in milliseconds.
mapper.readValue("{\"ttl\":\"P1Y\"}", Cfg.class);

// Attack: 'P' + N nines + 'Y' forces an N-digit BigInteger parse.
String big = "P" + "9".repeat(1_000_000) + "Y";
mapper.readValue("{\"ttl\":\"" + big + "\"}", Cfg.class);

On affected versions the second call spends many seconds of single-thread CPU parsing the giant BigInteger, where the baseline value returns in milliseconds; an XMLGregorianCalendar field is equally affected through the fractional-seconds path (for example {"at":"00:00:00." + "9"×N}). On a fixed release the oversized value is rejected with a StreamConstraintsException before the datatype factory is reached.

Mitigation

Only recent versions of Jackson are community-supported. The affected 2.13.x, 2.14.x, and 2.15.x lines are End-of-Life and will not receive public updates to address this issue. There is no publicly available fix for these lines; NES for Jackson is the remedy.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-databind to a currently supported 2.x release that contains the fix, such as 2.18.10 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• waydeshi (finder)