# CVE-2026-68497: FasterXML jackson-databind quadratic parse in XML datatype deserialization Source: https://junglewise.ai/threats/cve-2026-68497-fasterxml-jackson-databind-quadratic-parse-in-xml-datatype Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-09-11. Updated: 2026-09-26 License: CC BY 4.0 with a link back CVE-2026-68497 · Severity: high · CVSS 7.5 · Published 2026-09-11 jackson-databind, a widely-used JSON parsing library, has a performance vulnerability in its XML datatype handling. When deserializing Duration or XMLGregorianCalendar fields, the library passes raw JSON strings directly to underlying Java parsers without validating string length, allowing an attacker to submit specially crafted payloads (e.g., millions of digits) that force the server to spend minutes of CPU work processing a single request, leading to service degradation and denial of service. Technologies: [FasterXML Jackson Databind](https://junglewise.ai/threats/technologies/jackson-databind), [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind), [tools.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/tools-jackson-core-jackson-databind). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml), [Maven](https://junglewise.ai/threats/vendors/maven). ## Quick answers **Is CVE-2026-68497 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-68497 being exploited in the wild. **How severe is CVE-2026-68497?** High severity, with a CVSS score of 7.5, published 11 September 2026. **Which products and versions are affected?** FasterXML Jackson Databind 2.0.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6, 3.2.0 before 3.2.2; com.fasterxml.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=2.14.0,fixed=2.18.10; tools.jackson.core:jackson-databind (Maven) ECOSYSTEM:introduced=3.2.0,fixed=3.2.2. **Is there a fix for CVE-2026-68497?** Yes. com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later; tools.jackson.core:jackson-databind (Maven): upgrade to 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **How is CVE-2026-68497 attacked?** It is attacked over the network, in a software library. **Am I affected by CVE-2026-68497?** Check whether you run FasterXML Jackson Databind, com.fasterxml.jackson.core:jackson-databind (Maven) or tools.jackson.core:jackson-databind (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - com.fasterxml.jackson.core:jackson-databind (Maven): upgrade to 2.18.10 or later ```sh # set com.fasterxml.jackson.core:jackson-databind to 2.18.10 in your pom.xml or build.gradle ``` - tools.jackson.core:jackson-databind (Maven): upgrade to 3.2.2 or later ```sh # set tools.jackson.core:jackson-databind to 3.2.2 in your pom.xml or build.gradle ``` ## Technical details The vulnerability is a quadratic-complexity algorithmic DoS in the javax.xml.datatype.DatatypeFactory parsing of Duration and XMLGregorianCalendar values. When jackson-databind deserializes these types, it bypasses its normal StreamReadConstraints.maxNumberLength guards by passing JSON string tokens directly to DatatypeFactory methods, which then construct BigInteger and BigDecimal objects from the digit sequences via Java's native constructors—both of which have quadratic behavior on large digit counts. An unauthenticated attacker can submit a JSON payload of a few megabytes (e.g., the string "P" + millions of digits + "Y" for a Duration) to force tens of seconds to minutes of single-threaded CPU consumption per request. Affected versions: jackson-databind 2.0.0–2.18.9, 2.19.0–2.21.5, 2.22.0–2.22.1, 3.0.0–3.1.5, and 3.2.0–3.2.1. Patches are available in 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2. ## Affected products - FasterXML jackson-databind 2.0.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0 before 2.22.2, 3.0.0 before 3.1.6, 3.2.0 before 3.2.2 ## Identifiers - CVE-2026-68497 - GHSA-q4xh-88c3-wmh7 ## Timeline - 2026-09-11: disclosed: CVE-2026-68497 published - 2026-09-11: patched: Fixes available in versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2 ## Related threats - [jackson-databind type validation bypass in generic arguments](https://junglewise.ai/threats/cve-2026-110879-jackson-databind-validates-the-outer-class-of-a-class-name-type) - [Jackson Protobuf Parser integer overflow in string key parsing](https://junglewise.ai/threats/cve-2026-110747-protobufparser-readstringkey-reads-the-length-prefix-of-a) - [jackson-databind quadratic complexity in forward-reference resolution](https://junglewise.ai/threats/cve-2026-91777-jackson-databind-quadratic-forward-reference-completion) - [FasterXML Jackson Databind unbounded cache growth on unknown type IDs](https://junglewise.ai/threats/cve-2026-91776-jackson-databind-retains-every-unknown-raw-type-id) - [FasterXML Jackson Databind unsafe polymorphic type deserialization](https://junglewise.ai/threats/cve-2026-83557-fasterxml-jackson-databind-unsafe-polymorphic-type)