CVE-2026-68497: CWE-400 Uncontrolled Resource Consumption in FasterXML jackson-databind
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.
AI Analysis
Technical Summary
jackson-databind binds JSON strings to javax.xml.datatype.Duration or XMLGregorianCalendar fields by passing raw strings to DatatypeFactory methods without validating the length of numeric components. The XML Schema lexical grammar allows numeric parts of arbitrary length, which are parsed by JDK constructors with quadratic time complexity relative to digit count. Because these numeric components are inside JSON string tokens, jackson-core's maxNumberLength guard does not apply, and the XML datatype deserializer omits pre-checks. An attacker can submit a JSON Duration value with millions of digits, causing tens of seconds to minutes of CPU work per request, potentially saturating server threads and causing denial of service. The affected versions include jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, from 2.22.0 before 2.22.2, and from 3.0.0 before 3.1.6 and 3.2.0 before 3.2.2. Fixed versions are 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2.
Potential Impact
An unauthenticated attacker can cause a denial of service by submitting a single JSON request with a large numeric duration value, leading to excessive CPU consumption due to inefficient parsing. Multiple concurrent requests can saturate server worker threads, degrading or halting service availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available. Users should upgrade jackson-databind to versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 or later. Applying these updates will prevent the uncontrolled resource consumption vulnerability. No additional mitigation steps are indicated by the vendor advisory.
CVE-2026-68497: CWE-400 Uncontrolled Resource Consumption in FasterXML jackson-databind
Description
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.
CVSS v3.1
Score 7.5high
Affected software
FasterXML
jackson-databind
FasterXML
jackson-databind
pkg:maven/FasterXML/com.fasterxml.jackson.core:jackson-databindpkg:maven/FasterXML/tools.jackson.core:jackson-databindRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
jackson-databind binds JSON strings to javax.xml.datatype.Duration or XMLGregorianCalendar fields by passing raw strings to DatatypeFactory methods without validating the length of numeric components. The XML Schema lexical grammar allows numeric parts of arbitrary length, which are parsed by JDK constructors with quadratic time complexity relative to digit count. Because these numeric components are inside JSON string tokens, jackson-core's maxNumberLength guard does not apply, and the XML datatype deserializer omits pre-checks. An attacker can submit a JSON Duration value with millions of digits, causing tens of seconds to minutes of CPU work per request, potentially saturating server threads and causing denial of service. The affected versions include jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, from 2.22.0 before 2.22.2, and from 3.0.0 before 3.1.6 and 3.2.0 before 3.2.2. Fixed versions are 2.18.10, 2.21.6, 2.22.2, 3.1.6, and 3.2.2.
Potential Impact
An unauthenticated attacker can cause a denial of service by submitting a single JSON request with a large numeric duration value, leading to excessive CPU consumption due to inefficient parsing. Multiple concurrent requests can saturate server worker threads, degrading or halting service availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available. Users should upgrade jackson-databind to versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 or later. Applying these updates will prevent the uncontrolled resource consumption vulnerability. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- HeroDevs
- Date Reserved
- 2026-07-30T15:20:37.473Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa4262f91cc7f38485e062a
Added to database: 09/11/2026, 16:02:55 UTC
Last enriched: 09/11/2026, 16:16:59 UTC
Last updated: 09/11/2026, 16:48:40 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.