CVE-2026-68497: jackson-databind DOS Vulnerability

CVE-2026-68497 Overview

CVE-2026-68497 is a denial-of-service vulnerability in jackson-databind, the widely deployed Java JSON processing library maintained by FasterXML. The flaw resides in CoreXMLDeserializers.Std._deserialize, which passes raw JSON string content directly to DatatypeFactory.newDuration(value) and newXMLGregorianCalendar(value) without length validation. An unauthenticated remote attacker can submit a small JSON payload containing a javax.xml.datatype.Duration or XMLGregorianCalendar value with millions of digits, triggering quadratic-time parsing inside the JDK's BigInteger(String) and BigDecimal(String) constructors. The result is sustained single-threaded CPU exhaustion per request, and a handful of concurrent requests can saturate a server's worker pool [CWE-400].

Critical Impact
A single request of a few megabytes can consume tens of seconds to several minutes of CPU time, enabling denial of service against any Java service using a default ObjectMapper or JsonMapper.

Affected Products

com.fasterxml.jackson.core:jackson-databind 2.0.0 through 2.18.9, 2.19.0 through 2.21.5, and 2.22.0 through 2.22.1
tools.jackson.core:jackson-databind 3.0.0 through 3.1.5 and 3.2.0 through 3.2.1
Any Java application or service using a default ObjectMapper or JsonMapper that deserializes untrusted JSON into fields typed as javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar

Discovery Timeline

2026-09-11 - CVE-2026-68497 published to NVD
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-68497

Vulnerability Analysis

The CoreXMLDeserializers module registers deserializers for javax.xml.datatype.Duration and javax.xml.datatype.XMLGregorianCalendar by default. No polymorphic typing, no custom module, and no opt-in configuration is required to reach the vulnerable code path. When jackson-databind encounters a JSON string bound to one of these types, it passes the string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value).

The XML Schema lexical grammar permits numeric components of arbitrary length. The JDK materializes those components using BigInteger(String) and BigDecimal(String), both of which run in quadratic time relative to digit count. A value such as P followed by several million digits and Y forces the parser into extended CPU-bound work on a single thread.

Root Cause

Jackson's built-in NumberDeserializers call validateIntegerLength or validateFPLength before parsing stringified numbers, honoring the StreamReadConstraints.maxNumberLength guard. The XML datatype deserializer omits this pre-check. Because the payload sits inside a JSON string token rather than a JSON number token, the jackson-core number-length constraint never applies, leaving no default bound on input size.

Attack Vector

Exploitation requires only network access to an endpoint that deserializes attacker-controlled JSON into an affected field type. The attacker submits a payload similar to {"duration":"P<millions-of-digits>Y"}. Processing that single request occupies a worker thread for an extended interval. Repeating the request in parallel saturates the server's thread pool and denies service to legitimate clients.

text

#6127: Add `StreamReadConstraints` number len constraint to GregorianCalendar
  and Duration [GHSA-q4xh-88c3-wmh7] GHSA-q4xh-88c3-wmh7
 (reported by @waydeshi)
 (fix by @pjfanning)

Source: GitHub Commit a99b7e74

Detection Methods for CVE-2026-68497

Indicators of Compromise

Inbound HTTP requests containing JSON string fields with abnormally long numeric content (hundreds of kilobytes to megabytes of digits)
Requests targeting endpoints that bind to javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar with payloads matching patterns like P\d{10000,}Y or long lexical XSD date/time strings
Sustained 100% CPU on a single JVM worker thread correlated with a single inbound request

Detection Strategies

Inventory application dependencies for vulnerable jackson-databind coordinates and versions using software composition analysis
Add web application firewall rules that reject JSON string values above a reasonable size threshold on API endpoints
Enable JVM thread and CPU profiling to alert on threads stuck inside java.math.BigInteger.<init> or com.sun.org.apache.xerces.internal.jaxp.datatype.DurationImpl

Monitoring Recommendations

Track request latency distribution per endpoint and alert on sudden long-tail spikes indicative of algorithmic complexity abuse
Monitor thread pool saturation and rejected task counts in application servers such as Tomcat, Jetty, and Netty
Correlate elevated CPU utilization with request size metrics to identify small-payload, high-cost requests

How to Mitigate CVE-2026-68497

Immediate Actions Required

Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2 depending on the branch in use
Audit application code for fields typed as javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar exposed through JSON endpoints
Deploy request-size limits at the reverse proxy or API gateway to cap JSON payload size for affected endpoints

Patch Information

The fix, tracked as pull request #6127 and delivered in commit a99b7e74c8928f43f6975773a8c862c8316178bd, applies the existing StreamReadConstraints number-length constraint to the XML datatype deserializers so that oversized numeric content is rejected before it reaches BigInteger or BigDecimal. Details are published in the GitHub Security Advisory GHSA-q4xh-88c3-wmh7 and Pull Request #6127.

Workarounds

Register a custom deserializer for Duration and XMLGregorianCalendar that enforces a maximum input length before delegating to DatatypeFactory
Remove the default JaxbAnnotationModule or CoreXMLDeserializers registration where these XML datatypes are not required
Enforce strict maximum request-body sizes and per-field string-length validation at the application boundary

bash

# Maven dependency upgrade example
mvn versions:use-dep-version \
  -Dincludes=com.fasterxml.jackson.core:jackson-databind \
  -DdepVersion=2.18.10 \
  -DforceVersion=true

# Gradle equivalent in build.gradle
# implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.6'