CVE-2026-68497: FasterXML jackson-databind quadratic parse in XML datatype deserialization

CVE-2026-68497 · Severity: high · CVSS 7.5 · Published 2026-09-11

jackson-databind, a widely-used JSON parsing library, has a performance vulnerability in its XML datatype handling. When deserializing Duration or XMLGregorianCalendar fields, the library passes raw JSON strings directly to underlying Java parsers without validating string length, allowing an attacker to submit specially crafted payloads (e.g., millions of digits) that force the server to spend minutes of CPU work processing a single request, leading to service degradation and denial of service.

Technologies: FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven), tools.jackson.core:jackson-databind (Maven). Vendors: FasterXML, Maven.

Quick answers

Is CVE-2026-68497 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68497 being exploited in the wild.
How severe is CVE-2026-68497?
High severity, with a CVSS score of 7.5, published 11 September 2026.
Which products and versions are affected?
FasterXML Jackson Databind 2.0.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6, 3.2.0 before 3.2.2; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.14.0,fixed=2.18.10; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.2.0,fixed=3.2.2.
Is there a fix for CVE-2026-68497?
Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-68497 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-68497?
Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later
    # set com.fasterxml.jackson.core:jackson-databind to 2.18.10 in your pom.xml or build.gradle
  • tools.jackson.core:jackson-databind (Maven): upgrade to 3.2.2 or later
    # set tools.jackson.core:jackson-databind to 3.2.2 in your pom.xml or build.gradle

Technical details

The vulnerability is a quadratic-complexity algorithmic DoS in the javax.xml.datatype.DatatypeFactory parsing of Duration and XMLGregorianCalendar values. When jackson-databind deserializes these types, it bypasses its normal StreamReadConstraints.maxNumberLength guards by passing JSON string tokens directly to DatatypeFactory methods, which then construct BigInteger and BigDecimal objects from the digit sequences via Java's native constructors—both of which have quadratic behavior on large digit counts. An unauthenticated attacker can submit a JSON payload of a few megabytes (e.g., the string "P" + millions of digits + "Y" for a Duration) to force tens of seconds to minutes of single-threaded CPU consumption per request. Affected versions: jackson-databind 2.0.0–2.18.9, 2.19.0–2.21.5, 2.22.0–2.22.1, 3.0.0–3.1.5, and 3.2.0–3.2.1. Patches are available in 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2.

Affected products

  • FasterXML jackson-databind 2.0.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6, 3.2.0 before 3.2.2

Identifiers

  • CVE-2026-68497
  • GHSA-q4xh-88c3-wmh7

Timeline

  • 2026-09-11: disclosed: CVE-2026-68497 published
  • 2026-09-11: patched: Fixes available in versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.