CVE-2026-68497
HighCVSS 7.5Summary
A vulnerability in jackson-databind allows XML datatype deserializers (Duration, XMLGregorianCalendar) to pass raw JSON strings directly to BigInteger/BigDecimal constructors, which are quadratic in digit count. Because the digits are inside a string token rather than a number token, the StreamReadConstraints.maxNumberLength guard does not apply, enabling an attacker to cause excessive CPU consumption with a single request.
Risk Assessment
An unauthenticated attacker can send a few concurrent requests with very long Duration values, exhausting server worker threads and causing a denial of service (DoS). The vulnerability affects default ObjectMapper/JsonMapper configurations without any opt-in.
Recommendation
Upgrade jackson-databind to version 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 depending on the branch in use. Until patched, consider limiting incoming request sizes and monitoring for unusual CPU usage.
Other vulnerabilities in jackson-databind
See all- CVE-2021-20190High
A flaw in jackson-databind before 2.9.10.7 mishandles the interaction between serialization gadgets and typing. The highest threat is to data confidentiality, integrity, and system availability.
- CVE-2026-83557Medium
The DefaultBaseTypeLimitingValidator in jackson-databind, applied automatically when @JsonTypeInfo is used without a custom validator, omitted java.lang.Comparable from its list of unsafe base types. As a result, an application declaring an @JsonTypeInfo-annotated property or class with Comparable as its base type accepts type identifiers for essentially any class implementing Comparable, giving an attacker-controlled object instantiation primitive. A demonstrated case constructs a java.io.File for an arbitrary attacker-chosen path.
- CVE-2026-19032Medium
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. This can allow selecting and driving an arbitrary registered FileSystemProvider during deserialization of untrusted JSON. Impact is limited if only JDK built-in providers are present, but can be more severe with third-party providers on the classpath.
- CVE-2026-77310Medium
jackson-databind, the general-purpose data-binding functionality and tree-model for Jackson Data Processor, prior to versions 2.18.9, 2.21.5, 2.22.1, 3.1.5, and 3.2.1, has a vulnerability in the java.net.InetAddress branch of FromStringDeserializer.Std._deserialize(). It calls InetAddress.getByName() on attacker-controlled input, causing eager DNS resolution during deserialization and enabling DNS-based server-side request forgery and internal-host enumeration.
- CVE-2026-59889Medium
In jackson-databind, the UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without a prop.visibleInView() guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view.
- CVE-2026-59888Medium
A vulnerability in jackson-databind allows bypassing @JsonIgnore in Java Records using PropertyNamingStrategy. Affected versions from 2.15.0 to 2.18.8, 2.21.4, and 3.1.4 register the ignored field under its original name before applying the naming strategy, enabling the renamed JSON key to be assigned to the Record constructor parameter.
- CVE-2026-54515Medium
In jackson-databind from version 2.8.0 to 2.18.9, 2.21.5, and 3.1.4, a vulnerability exists where per-property @JsonIgnoreProperties exclusions are applied by removing ignored properties from BeanPropertyMap, but subsequent case-insensitivity processing (ACCEPT_CASE_INSENSITIVE_PROPERTIES) rebuilds the map from the original unfiltered source, restoring the removed properties. The ignored property becomes writable again.
- CVE-2026-54514Medium
Vulnerability in jackson-databind from version 2.0.0 to 2.18.8, 2.21.4, and 3.1.4 causes immediate DNS resolution for untrusted input during deserialization of InetSocketAddress. An attacker can force a DNS query to a chosen host before any application-level validation.
- CVE-2026-54513High
Jackson-databind from 2.10.0 to 2.18.8, 2.21.4, and 3.1.4 has a vulnerability in BasicPolymorphicTypeValidator where allowIfSubTypeIsArray() allows any array type without validating the element type. This bypasses the allowlist and allows deserialization of dangerous types like EvilType[].
- CVE-2023-35116Medium
Jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies.
Original NVD description (English source)
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.