high 7.5

CVE-2026-68497 json

jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

published 2026-09-11 59 d ago modified 2026-09-28 41 d ago also EUVD-2026-76142 , GHSA-q4xh-88c3-wmh7

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Patch / fix

fixed in 3 distros 6 links 7

maven tools.jackson.core:jackson-databind 3.1.6, 3.2.2
maven com.fasterxml.jackson.core:jackson-databind 2.18.10, 2.21.6, 2.22.2
FasterXML jackson-databind 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2

debian red hat suse opensuse almalinux rocky linux

jackson-databind Debian 14 2.18.11-1

debian advisories DEBIAN-CVE-2026-68497

jackson-modules-base RHEL 9 2.21.6-1.el9_8
jackson-core RHEL 9 2.21.6-1.el9_8
jackson-databind RHEL 9 2.21.6-1.el9_8
pki-jackson-core RHEL 9 2.21.6-1.el9_8
pki-jackson-databind RHEL 9 2.21.6-1.el9_8
jackson-jaxrs-providers RHEL 9 2.21.6-1.el9_8
pki-jackson-jaxrs-providers RHEL 9 2.21.6-1.el9_8
pki-jackson-jaxrs-json-provider RHEL 9 2.21.6-1.el9_8

red hat advisories RHSA-2026:80504 RHSA-2026:77648

jackson-databind SLES for SAP applications 16.0, SLES 16.0 2.18.11-160000.1.1
jackson-core SLES for SAP applications 16.0, SLES 16.0 2.18.11-160000.1.1
jackson-annotations SLES for SAP applications 16.0, SLES 16.0 2.18.11-160000.1.1
jackson-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.30.1
jackson-databind SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.36.1
jackson-annotations SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.28.1
jackson-dataformat-xml SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.5.8.1
jackson-dataformats-binary SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +8 more 2.18.11-150200.3.29.1

suse advisories SUSE-SU-2026:24149-1 SUSE-SU-2026:4394-1

jackson-databind openSUSE Leap 16.0 2.18.11-160000.1.1
jackson-core openSUSE Leap 16.0 2.18.11-160000.1.1
jackson-annotations openSUSE Leap 16.0 2.18.11-160000.1.1
jackson-databind openSUSE Tumbleweed 2.18.11-1.1

opensuse advisories openSUSE-SU-2026:22034-1 openSUSE-SU-2026:11877-1

pki-jackson-core AlmaLinux 9 2.21.6-1.el9_8
pki-jackson-databind AlmaLinux 9 2.21.6-1.el9_8
pki-jackson-jaxrs-providers AlmaLinux 9 2.21.6-1.el9_8
pki-jackson-jaxrs-json-provider AlmaLinux 9 2.21.6-1.el9_8
pki-jackson-module-jaxb-annotations AlmaLinux 9 2.21.6-1.el9_8
idm-pki-ca AlmaLinux 10 11.9.0-6.el10_2.alma.1
idm-pki-kra AlmaLinux 10 11.9.0-6.el10_2.alma.1
idm-pki-acme AlmaLinux 10 11.9.0-6.el10_2.alma.1

almalinux advisories ALSA-2026:80504 ALSA-2026:77648

jackson-modules-base Rocky Linux 9 2.21.6-1.el9_8
jackson-core Rocky Linux 9 2.21.6-1.el9_8
jackson-databind Rocky Linux 9 2.21.6-1.el9_8
jackson-jaxrs-providers Rocky Linux 9 2.21.6-1.el9_8
dogtag-pki Rocky Linux 10 11.9.0-6.el10_2.rocky.0.1

rocky linux advisories RLSA-2026:80504 RLSA-2026:77648

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-68497 updated 2026-11-05 cvss 7.5

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

Red Hat Exploit Intelligence exploit-intelligence/agent-client-rhel9 Red Hat OpenShift Developer Tools and Services jenkins 2.516.3.1758206866-3.el9, jenkins-2-plugins 4.19.1758207171-1.el9 Red Hat OpenShift Serverless openshift-serverless-1/kn-ekb-receiver-rhel9, openshift-serverless-1/kn-ekb-dispatcher-rhel9, openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, +4 more
affected: workaround, no fix available “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”
Red Hat AI Inference Server rhaii/vllm-gaudi-rhel9, rhaiis/vllm-cuda-rhel9
affected: workaround, no fix planned “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”
Red Hat AMQ Broker 7 jackson-databind 2.22.1.redhat-00003 Red Hat build of Apache Camel - HawtIO 4 jackson-databind 2.22.1.redhat-00003, rhaf-hawtio-maven-repository.zip 4.4.0.GA Red Hat build of Apache Camel 4 for Quarkus 3 jackson-databind 2.22.1.redhat-00003 Red Hat build of Apicurio Registry 3 jackson-databind 2.22.1.redhat-00003 Red Hat build of Debezium 3 jackson-databind 2.22.1.redhat-00003 Red Hat Ceph Storage 8 liborc1

+6 more productsfewer

Red Hat Ceph Storage 9 liborc, liborc2, libarrow, parquet-libs Red Hat Certificate System 10 redhat-pki 11.9.2-4.module+el8pki+24565+7517ad63 Red Hat Certificate System 11 redhat-pki 11.10.1-1.el10_2 Red Hat Data Grid 8 jackson-databind 2.22.1.redhat-00003 Red Hat Enterprise Linux 8 jss, pki-ca, idm-jss, ldapjdk, pki-kra, pki-acme, +25 more Red Hat Enterprise Linux 9 pki-ca, pki-kra, pki-acme, pki-base, pki-core, pki-tools, +13 more

affected: workaround, no fix available “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-gaudi-rhel9 Red Hat JBoss Enterprise Application Platform 7 jackson-databind 2.22.1.redhat-00003, jboss-eap-7/eap74-els-openjdk8-openshift-rhel8, jboss-eap-7/eap74-els-openjdk11-openshift-rhel8, jboss-eap-7/eap74-els-openjdk17-openshift-rhel8
affected: workaround, no fix planned “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”
Red Hat JBoss Enterprise Application Platform 8 jackson-databind 2.22.1.redhat-00003 Red Hat JBoss Enterprise Application Platform Expansion Pack jackson-databind 2.22.1.redhat-00003 Red Hat JBoss Web Server 7 jboss-webserver-7/jws70-openjdk17-openshift-rhel9, jboss-webserver-7/jws70-openjdk17-rhel9-openshift, jboss-webserver-7/jws70-openjdk21-openshift-rhel9, jboss-webserver-7/jws70-openjdk21-rhel9-openshift Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) rhai-early-access/docling-serve-cuda-rhel9 Red Hat OpenShift Dev Spaces devspaces/server-rhel9
affected: workaround, no fix available “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”
Red Hat OpenStack Platform 13 (Queens) opendaylight
affected: workaround, no fix planned “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”
Red Hat Satellite 6 puppetserver
affected: workaround, no fix available “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”
Red Hat Single Sign-On 7 jackson-databind 2.22.1.redhat-00003
affected: workaround, no fix planned “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.”

show 13 more

Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1792044326
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88152
Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1792044327
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88149
Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1792044382
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88151
Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1792044386
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88150
Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1792040287
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88156
Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1792040131
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88159
Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1792041514
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88153
Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1792040733
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88158
Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1792040081
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88157
Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1792040096
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88155
Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1792040428
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:88154
Red Hat Build of Apache Camel 3.33.4.redhat jackson-databind 2.21.7.redhat-00001
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:83670
Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
fixed: vendor fix “Upgrade jackson-databind to 2.18.10, 2.21.6, 2.22.2, or later fixed releases as applicable. Until updated, restrict untrusted JSON input size and complexity.” RHSA-2026:71675

19 more fixed, 31 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: yes
Technical impact: partial
Assessed: 59 d ago (2026-09-11)

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
maven	tools.jackson.core:jackson-databind	>=3.2.0, <3.2.2 >=3.0.0, <3.1.6	3.2.2 3.1.6
maven	com.fasterxml.jackson.core:jackson-databind	>=2.14.0, <2.18.10 >=2.19.0, <2.21.6 >=2.22.0, <2.22.2	2.18.10 2.21.6 2.22.2

Affected products

FasterXML jackson-databind

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-1333 Inefficient Regular Expression Complexity

References

github.com /FasterXML/jackson-databind/pull/6127
patch, issue-tracking, web
github.com /FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd
patch, web
github.com /FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7
third-party-advisory, exploit, web
nvd.nist.gov /vuln/detail/CVE-2026-68497
advisory
github.com /FasterXML/jackson-databind
package
github.com /FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10
web
github.com /FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6
web
github.com /FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2
web
github.com /FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6
web
github.com /FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary