Skip to content
OpenAdvisories
High · 7.5 CVE-2026-68497 EUVD-2026-76142GHSA-q4xh-88c3-wmh7

jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

Published Sep 11, 2026 · Updated Sep 11, 2026 · Assigned by HeroDevs

Vendor: FasterXML Product: jackson-databind Package: akhq Package: apache-pulsar-4.2 Package: apache-tika-3.1 Package: apache-tika-3.2 Package: apache-tika-3.3 Package: apicurio-registry Package: cassandra-4.1 Package: cassandra-5.0 Package: cassandra-reaper Package: celeborn-0.6 Package: com.fasterxml.jackson.core:jackson-databind Package: confluent-kafka Package: dependency-track Package: dependency-track-bundled Package: druid Package: flyway Package: gradle-8 Package: gradle-9 Package: gradle-stage0 Package: infinispan-16.1 Package: infinispan-16.2 Package: jackson-databind Package: jackson-databind Package: jenkins-plugin-manager Package: kafka-4.1 Package: kafka-4.2 Package: keycloak-config-cli Package: keycloak-config-cli-iamguarded-compat Package: kserve-modelmesh Package: logstash-9.3 Package: logstash-9.3-iamguarded-compat Package: logstash-9.4 Package: logstash-9.4-iamguarded-compat Package: neo4j-2026.05 Package: neo4j-2026.06 Package: neo4j-2026.07 Package: nextflow Package: opensearch-2 Package: opensearch-3 Package: opensearch-3-alerting Package: opensearch-3-anomaly-detection Package: opensearch-3-crypto-kms Package: opensearch-3-discovery-ec2 Package: opensearch-3-ml-commons Package: opensearch-3-neural-search Package: opensearch-3-notifications Package: opensearch-3-observability Package: opensearch-3-performance-analyzer Package: opensearch-3-reporting Package: opensearch-3-repository-azure Package: opensearch-3-repository-s3 Package: opensearch-3-security Package: opensearch-3-sql Package: ruby3.2-jrjackson Package: ruby3.3-jrjackson Package: ruby3.4-jrjackson Package: ruby4.0-jrjackson Package: scala-3.8 Package: solr-10 Package: solr-10-iamguarded-compat Package: sonarqube Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: spdx-tools-java Package: strimzi-kafka-oauth-m2 Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: tez Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: tools.jackson.core:jackson-databind Package: trino Package: trino-plugin-ai-functions Package: trino-plugin-bigquery Package: trino-plugin-blackhole Package: trino-plugin-cassandra Package: trino-plugin-clickhouse Package: trino-plugin-delta-lake Package: trino-plugin-druid Package: trino-plugin-duckdb Package: trino-plugin-elasticsearch Package: trino-plugin-exasol Package: trino-plugin-exchange-filesystem Package: trino-plugin-exchange-hdfs Package: trino-plugin-faker Package: trino-plugin-functions-python Package: trino-plugin-geospatial Package: trino-plugin-google-sheets Package: trino-plugin-hive Package: trino-plugin-http-event-listener Package: trino-plugin-hudi Package: trino-plugin-iceberg Package: trino-plugin-ignite Package: trino-plugin-jmx Package: trino-plugin-kafka Package: trino-plugin-kafka-event-listener Package: trino-plugin-lakehouse Package: trino-plugin-ldap-group-provider Package: trino-plugin-loki Package: trino-plugin-mariadb Package: trino-plugin-memory Package: trino-plugin-ml Package: trino-plugin-mongodb Package: trino-plugin-mysql Package: trino-plugin-mysql-event-listener Package: trino-plugin-opa Package: trino-plugin-openlineage Package: trino-plugin-opensearch Package: trino-plugin-oracle Package: trino-plugin-password-authenticators Package: trino-plugin-pinot Package: trino-plugin-postgresql Package: trino-plugin-prometheus Package: trino-plugin-ranger Package: trino-plugin-redis Package: trino-plugin-redshift Package: trino-plugin-resource-group-managers Package: trino-plugin-session-property-managers Package: trino-plugin-singlestore Package: trino-plugin-snowflake Package: trino-plugin-spooling-filesystem Package: trino-plugin-sqlserver Package: trino-plugin-thrift Package: trino-plugin-tpcds Package: trino-plugin-tpch Package: wavefront-proxy Package: wildfly-openjdk-17 Package: wildfly-openjdk-21 Package: zipkin Package: zipkin-slim Package: zookeeper-3.9 Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Affected products

VendorProductAffectedFixed
FasterXML jackson-databind 2.0.0 – < 2.18.10, 2.19.0 – < 2.21.6, 2.22.0 – < 2.22.2, 3.0.0 – < 3.1.6, 3.2.0 – < 3.2.2 2.18.10

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jackson-databind 2.18.11-1 —
Debian 13 jackson-databind No fix yet —
Debian 12 jackson-databind No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 jackson-databind No fix yet —
Ubuntu 26.04 LTS jackson-databind No fix yet —
Ubuntu 24.04 LTS jackson-databind No fix yet —
Ubuntu 22.04 LTS jackson-databind No fix yet —
Ubuntu 20.04 LTS jackson-databind No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS jackson-databind No fix yet —
Ubuntu Pro 16.04 LTS jackson-databind No fix yet —
Ubuntu Pro 14.04 LTS jackson-databind No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 dogtag-pki +8 11.9.0-6.el10_2 RHSA-2026:77648
RHEL 9 jackson-core +8 2.21.6-1.el9_8 RHSA-2026:80504
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 openvox-agent 8.31.1-1.el8sat RHSA-2026:92861, RHSA-2026:92860, RHSA-2026:92859
Red Hat Satellite Capsule 6 openvox-server 8.17.0-1.el8sat RHSA-2026:92861, RHSA-2026:92860, RHSA-2026:92859
Red Hat Satellite Capsule 6 python3.12-brotli 1.2.1-1.el9pc RHSA-2026:92861
Red Hat Satellite Capsule 6 python3.12-django 4.2.30-3.el9pc RHSA-2026:92861
Red Hat Satellite Capsule 6 python3.12-gitpython 3.2.1-1.el9pc RHSA-2026:92861
Red Hat Satellite Capsule 6 python3.12-pillow 13.0.0-1.el9pc RHSA-2026:92861
Red Hat Satellite Capsule 6 python3.12-pulp-ansible 1:0.28.10-1.el9pc RHSA-2026:92861
Red Hat Satellite Capsule 6 python3.12-urllib3 2.8.0-1.el9pc RHSA-2026:92861
Red Hat Satellite 6 openvox-agent 8.31.1-1.el8sat RHSA-2026:92861, RHSA-2026:92860, RHSA-2026:92859
Red Hat Satellite 6 openvox-server 8.17.0-1.el8sat RHSA-2026:92861, RHSA-2026:92860, RHSA-2026:92859
Red Hat Satellite 6 python3.12-brotli 1.2.1-1.el9pc RHSA-2026:92861
Red Hat Satellite 6 python3.12-django 4.2.30-3.el9pc RHSA-2026:92861
Red Hat Satellite 6 python3.12-gitpython 3.2.1-1.el9pc RHSA-2026:92861
Red Hat Satellite 6 python3.12-pillow 13.0.0-1.el9pc RHSA-2026:92861
Red Hat Satellite 6 python3.12-pulp-ansible 1:0.28.10-1.el9pc RHSA-2026:92861
Red Hat Satellite 6 python3.12-urllib3 2.8.0-1.el9pc RHSA-2026:92861
Red Hat Satellite 6 yggdrasil-worker-forwarder 0.1.1-1.el8sat RHSA-2026:92861, RHSA-2026:92860, RHSA-2026:92859
RHEL 10.0 EUS dogtag-pki +8 11.6.0-3.el10_0.1 RHSA-2026:86621
RHEL 9.6 EUS jackson-core +6 2.21.6-1.el9_6 RHSA-2026:89734
RHEL 9.6 EUS jackson-databind +1 2.21.6-1.el9_6.1 RHSA-2026:89734
RHEL 9.4 E4S jackson-annotations +1 2.21-1.el9_4.1 RHSA-2026:93444
RHEL 9.4 E4S jackson-core +6 2.21.6-1.el9_4 RHSA-2026:93444
RHEL 9.4 E4S jackson-databind +1 2.21.6-1.el9_4.1 RHSA-2026:93444
RHEL 9.2 E4S jackson-databind +1 2.21.6-1.el9_2.1 RHSA-2026:89924

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 idm-pki-ca +7 11.9.0-6.el10_2.alma.1 ALSA-2026:77648
AlmaLinux 9 pki-jackson-core +4 2.21.6-1.el9_8 ALSA-2026:80504

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 dogtag-pki 11.9.0-6.el10_2.rocky.0.1 RLSA-2026:77648
Rocky Linux 9 jackson-core +3 2.21.6-1.el9_8 RLSA-2026:80504

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLES 15 SP7 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLES 15 SP7 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLES 15 SP7 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLES 15 SP7 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
SLES 15 SP6 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLES 15 SP6 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLES 15 SP6 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLES 15 SP6 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLES 15 SP6 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
SLES 15 SP5 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLES 15 SP5 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLES 15 SP5 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLES 15 SP5 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLES 15 SP5 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
SLES 15 SP4 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLES 15 SP4 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLES 15 SP4 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLES 15 SP4 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLES 15 SP4 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 jackson-core +2 2.18.11-160000.1.1 SUSE-SU-2026:24149-1
SLES for SAP 15 SP6 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP6 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP6 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP6 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP6 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP5 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP5 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP5 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP5 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP5 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP4 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP4 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP4 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP4 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLES for SAP 15 SP4 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
SLES 16.0 jackson-core +2 2.18.11-160000.1.1 SUSE-SU-2026:24149-1
SLE HPC 15 SP5 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP5 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP5 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP5 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP5 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP4 jackson-annotations 2.18.11-150200.3.28.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP4 jackson-core 2.18.11-150200.3.30.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP4 jackson-databind 2.18.11-150200.3.36.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP4 jackson-dataformat-xml 2.18.11-150200.5.8.1 SUSE-SU-2026:4394-1
SLE HPC 15 SP4 jackson-dataformats-binary 2.18.11-150200.3.29.1 SUSE-SU-2026:4394-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed jackson-databind 2.18.11-1.1 openSUSE-SU-2026:11877-1
openSUSE Leap 16.0 jackson-core +2 2.18.11-160000.1.1 openSUSE-SU-2026:22034-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 jackson-databind 2.21.7-1.amzn2023.0.1 ALAS2023-2026-3305

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 idm-pki-ca +7 11.9.0-6.0.1.el10_2 ELSA-2026-77648
Oracle Linux 9 pki-jackson-core +4 2.21.6-1.el9_8 ELSA-2026-80504

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.28.0-r11 —
Wolfi rolling apache-pulsar-4.2 4.2.4-r7 —
Wolfi rolling apache-tika-3.1 3.1.0-r40 —
Wolfi rolling apache-tika-3.2 3.2.3-r19 —
Wolfi rolling apache-tika-3.3 3.3.2-r3 —
Wolfi rolling apicurio-registry 3.3.3-r3 —
Wolfi rolling cassandra-4.1 4.1.12-r2 —
Wolfi rolling cassandra-5.0 5.0.9-r8 —
Wolfi rolling cassandra-reaper 5.0.1-r3 —
Wolfi rolling celeborn-0.6 0.6.3-r18 —
Wolfi rolling confluent-kafka 8.5.0.235-r1 —
Wolfi rolling dependency-track +1 4.14.4-r1 —
Wolfi rolling druid 38.0.0-r0 —
Wolfi rolling flyway 13.9.0-r0 —
Wolfi rolling gradle-8 8.14.5-r8 —
Wolfi rolling gradle-9 9.8.0-r1 —
Wolfi rolling gradle-stage0 No fix yet —
Wolfi rolling infinispan-16.1 16.1.4-r12 —
Wolfi rolling infinispan-16.2 16.2.3-r1 —
Wolfi rolling jenkins-plugin-manager 2.15.0-r6 —
Wolfi rolling kafka-4.1 4.1.2-r10 —
Wolfi rolling kafka-4.2 4.2.2-r1 —
Wolfi rolling keycloak-config-cli +1 6.5.1-r19 —
Wolfi rolling kserve-modelmesh 0.12.0-r41 —
Wolfi rolling logstash-9.3 +1 9.3.8-r3 —
Wolfi rolling logstash-9.4 +1 9.4.7-r2 —
Wolfi rolling neo4j-2026.05 2026.05.0-r14 —
Wolfi rolling neo4j-2026.06 2026.06.0-r11 —
Wolfi rolling neo4j-2026.07 2026.07.1-r4 —
Wolfi rolling nextflow 26.04.6-r3 —
Wolfi rolling opensearch-2 2.19.6-r16 —
Wolfi rolling opensearch-3 +14 3.9.0-r0 —
Wolfi rolling ruby3.2-jrjackson +2 0.5.2-r2 —
Wolfi rolling ruby4.0-jrjackson 0.5.2-r3 —
Wolfi rolling scala-3.8 3.8.4-r11 —
Wolfi rolling solr-10 +1 10.0.0-r14 —
Wolfi rolling sonarqube 26.9.0.129388-r1 —
Wolfi rolling spark-4.0-scala-2.13 4.0.4-r8 —
Wolfi rolling spark-4.1-scala-2.13 4.1.3-r7 —
Wolfi rolling spdx-tools-java 2.0.7-r6 —
Wolfi rolling strimzi-kafka-oauth-m2 0.18.0-r2 —
Wolfi rolling strimzi-kafka-operator-kafka-init +7 1.2.0-r6 —
Wolfi rolling tez 0.10.5-r32 —
Wolfi rolling thingsboard-tb-node +1 4.3.1.5-r2 —
Wolfi rolling trino +53 483-r8 —
Wolfi rolling wavefront-proxy 13.9-r31 —
Wolfi rolling wildfly-openjdk-17 +1 41.0.1-r3 —
Wolfi rolling zipkin +1 3.6.1-r29 —
Wolfi rolling zookeeper-3.9 3.9.6-r2 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.fasterxml.jackson.core:jackson-databind >= 2.14.0, < 2.18.10 2.18.10 GHSA-q4xh-88c3-wmh7
Maven com.fasterxml.jackson.core:jackson-databind >= 2.19.0, < 2.21.6 2.21.6 GHSA-q4xh-88c3-wmh7
Maven com.fasterxml.jackson.core:jackson-databind >= 2.22.0, < 2.22.2 2.22.2 GHSA-q4xh-88c3-wmh7
Maven tools.jackson.core:jackson-databind >= 3.2.0, < 3.2.2 3.2.2 GHSA-q4xh-88c3-wmh7
Maven tools.jackson.core:jackson-databind >= 3.0.0, < 3.1.6 3.1.6 GHSA-q4xh-88c3-wmh7

Advisories 28

References