ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-68497

Duration XMLGregorianCalendar Unbounded Number Parse DoS

Published Aug 21, 2026 · catalog updated Aug 21, 2026 · BSI

Last checked Nov 3, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-68497. EPSS is 0.63%. Act only if a listed version of BSI is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.63%
Remediation
Version ranges on file
Affected products
maven com.fasterxml.jackson.core:jackson-databind · maven tools.jackson.core:jackson-databind

### Summary 3.2.1 deserializes a JSON **string** bound to a or field by passing the raw string verbatim to / . Per the XML-Schema lexical grammar these factory methods accept numeric components of arbitrary length, which the JDK materializes into / using the native constructor (an O(n²) parser). Because the digits reside inside a JSON **string** token, jackson-core's guard (which bounds only JSON *number* tokens) never fires, so there is no length limit anywhere on this path. An unauthenticated attacker can submit a single small request (e.g. ~1–5 MB) that forces tens of seconds to minutes of single-thread CPU consumption, yielding a denial of service under the default mapper with no polymorphic typing or special configuration. ### Details (jackson-core, default 1000) bounds the **text length of JSON number tokens** only; it does not apply to digits inside a JSON string token ( default is 100,000,000). jackson's own value binders compensate for this gap elsewhere — explicitly call / before parsing a *stringified* number ( , ). The XML-datatype deserializer omits this identical pre-check. registers deserializers **by default** for any field typed or ( ), with no opt-in required. hands the attacker string straight to the datatype factory: Per the XSD lexical rules, parses each numeric component (years, months, …) into a , and parses fractional seconds into a . The JDK uses the native / constructors, which are O(n²) in the digit count. A short JSON string such as therefore forces the allocation and O(N²) parse of an N-digit , entirely downstream of every jackson-core constraint. ## Vulnerable Code Location - — (TYPE_DURATION) - — (TYPE_G_CALENDAR fallback) - Registration (default, no opt-in): ( returns for / ) - Contrast — correct length-guard pattern already used elsewhere in the library: ## Proof of Concept PoC source ( ). It uses only the public API and a default mapper; the only "special" element is a normal DTO exposing a field. Minimal HTTP-shaped payload (what a

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • maven com.fasterxml.jackson.core:jackson-databind>= 2.14.0, < 2.18.10
  • maven com.fasterxml.jackson.core:jackson-databind>= 2.19.0, < 2.21.6
  • maven com.fasterxml.jackson.core:jackson-databind>= 2.22.0, < 2.22.2
  • maven tools.jackson.core:jackson-databind>= 3.0.0, < 3.1.6
  • maven tools.jackson.core:jackson-databind>= 3.2.0, < 3.2.2

How to fix CVE-2026-68497

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-68497. EPSS is 0.63%. Act only if a listed version of BSI is installed.

Which versions are affected?

Compare what you have installed with >= 2.14.0, < 2.18.10, >= 2.19.0, < 2.21.6, >= 2.22.0, < 2.22.2, >= 3.0.0, < 3.1.6, >= 3.2.0, < 3.2.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption. EPSS 0.63%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Jackson security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · BSI CERT-Bund

    Detected

    CVE-2026-68497 is listed by SOS GmbH JobScheduler: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff.

Sources

  • BSI CERT-BundGovernment advisoryCVE-2026-68497

    SOS GmbH JobScheduler: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

    wid.cert-bund.de
  • CVE.orgVulnerability recordCVE-2026-68497

    Official CVE identifier

    cve.org
  • Maintainer security tabsVendor advisoryGHSA-q4xh-88c3-wmh7

    ### Summary 3.2.1 deserializes a JSON **string** bound to a or field by passing the raw string verbatim to / . Per the XML-Schema lexical grammar these factory methods accept numeric components of arbitrary length, which the JDK materializes into / using the native constructor (an O(n²) parser). Because the digits reside inside a JSON **string** token, jackson-core's guard (which bounds only JSON

    github.com

Freshness

Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Maintainer security tabsNov 2, 2026
  • CVE.orgOct 31, 2026
  • BSI CERT-BundOct 31, 2026