Threats tagged 'ghsa-q4xh-88c3-wmh7'

CVE-2026-68497 is a high-severity denial of service vulnerability in FasterXML jackson-databind affecting versions >=2.0.0 <2.18.10, >=2.19.0 <2.21.6, >=2.22.0 <2.22.2, >=3.0.0 <3.1.6, and >=3.2.0 <3.2.2. It arises because the library deserializes JSON strings bound to javax.xml.datatype.Duration or XMLGregorianCalendar fields by passing them directly to JDK factory methods that parse numeric components with O(n²) complexity, without enforcing length limits on the string input. This allows an unauthenticated attacker to cause excessive CPU consumption and denial of service by submitting a specially crafted JSON string with very long numeric components. No polymorphic typing or special configuration is required to trigger this issue.