CVE-2026-68497

CVE-2026-68497 is an unauthenticated denial-of-service flaw in jackson-databind's default deserializers for javax.xml.datatype.Duration and javax.xml.datatype.XMLGregorianCalendar, which pass a JSON string token verbatim to the JDK's DatatypeFactory, whose BigInteger/BigDecimal constructors scale quadratically with digit count. An attacker can trigger it with a single request of a few megabytes — e.g., a Duration string of 'P' followed by millions of digits and 'Y' — because the digits sit inside a JSON string token, bypassing jackson-core's StreamReadConstraints.maxNumberLength guard and the length pre-checks used elsewhere. The attacker gains no code execution or data access, but forces tens of seconds to minutes of single-threaded CPU work per request, and a handful of concurrent requests can exhaust a server's worker threads. Any application using an affected jackson-databind version that binds untrusted JSON input to these XML datatype types is affected, including plain ObjectMapper/JsonMapper instances with default configuration and no polymorphic typing. No public proof-of-concept, in-the-wild exploitation, or KEV listing is currently known.

What to do: Upgrade to jackson-databind 2.18.10, 2.21.6, or 2.22.2 on the 2.x line, or 3.1.6 or 3.2.2 on the 3.x line. In the interim, audit whether your services deserialize untrusted JSON strings into javax.xml.datatype.Duration or XMLGregorianCalendar fields, reject or cap the length of string values for those fields, and apply rate limiting or worker-thread caps on the affected endpoints. Note that jackson-core's StreamReadConstraints number-length limit does not help here because the oversized digits are inside string tokens.