jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

[ Why it matters ]Priority signals

• Public proof-of-concept exploit exists (CISA SSVC)

[ Description ]Official description

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

[ Fixes ]Fixes and patches

• tools.jackson.core:jackson-databind 3.2.2Fixed version · GitHub Advisories · maven package tools.jackson.core:jackson-databind: upgrade to 3.2.2 or later (affected >= 3.2.0, < 3.2.2)
• tools.jackson.core:jackson-databind 3.1.6Fixed version · GitHub Advisories · maven package tools.jackson.core:jackson-databind: upgrade to 3.1.6 or later (affected >= 3.0.0, < 3.1.6)
• com.fasterxml.jackson.core:jackson-databind 2.18.10Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.18.10 or later (affected >= 2.14.0, < 2.18.10)
• com.fasterxml.jackson.core:jackson-databind 2.21.6Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.21.6 or later (affected >= 2.19.0, < 2.21.6)
• com.fasterxml.jackson.core:jackson-databind 2.22.2Fixed version · GitHub Advisories · maven package com.fasterxml.jackson.core:jackson-databind: upgrade to 2.22.2 or later (affected >= 2.22.0, < 2.22.2)

[ Advisories ]Government CERT advisories

• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4090

  Oracle Communications: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-101763CVE-2026-58389CVE-2026-56740+85 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4089

  Oracle Construction and Engineering: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-101736CVE-2026-91399CVE-2026-49844+9 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4086

  Oracle Financial Services Applications: Multiple vulnerabilities Translated from German

  Risk highCVE-2026-68497CVE-2026-41855CVE-2026-49844
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4062

  Oracle Utilities Applications: Multiple vulnerabilities Translated from German

  CVE-2026-49844CVE-2026-41239CVE-2026-68497+5 more CVEs
• BSI CERT-Bund20 Oct 2026WID-SEC-2026-4056

  Atlassian products (Bamboo, Bitbucket, Confluence, Crucible, Fisheye and Jira): Multiple vulnerabilities Translated from German

  CVE-2026-13676CVE-2026-50750CVE-2026-53404+72 more CVEs
• CERT-FR16 Oct 2026CERTFR-2026-AVI-1336

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-14671CVE-2026-11548CVE-2022-22950+490 more CVEs
• CERT-FR9 Oct 2026CERTFR-2026-AVI-1291

  Multiple vulnerabilities in IBM products Translated from French

  Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.

  CVE-2026-49978CVE-2025-27895CVE-2026-59651+195 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1249

  Multiple vulnerabilities in VMware products Translated from French

  Multiple vulnerabilities have been discovered in VMware products. They allow an attacker to cause a security problem not specified by the vendor.

  CVE-2026-75595CVE-2026-53910CVE-2026-56404+288 more CVEs
• BSI CERT-Bund29 Sep 2026WID-SEC-2026-3665

  SOS GmbH JobScheduler: Multiple vulnerabilities allow an unspecified attack Translated from German

  CVE-2026-19032CVE-2026-59889CVE-2026-9563+7 more CVEs

[ Packages ]Affected open-source packages

• tools.jackson.core:jackson-databind mavenAffected >= 3.2.0, < 3.2.2 · fixed in 3.2.2 · GHSA-q4xh-88c3-wmh7
• tools.jackson.core:jackson-databind mavenAffected >= 3.0.0, < 3.1.6 · fixed in 3.1.6 · GHSA-q4xh-88c3-wmh7
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.14.0, < 2.18.10 · fixed in 2.18.10 · GHSA-q4xh-88c3-wmh7
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.19.0, < 2.21.6 · fixed in 2.21.6 · GHSA-q4xh-88c3-wmh7
• com.fasterxml.jackson.core:jackson-databind mavenAffected >= 2.22.0, < 2.22.2 · fixed in 2.22.2 · GHSA-q4xh-88c3-wmh7

[ References ]References

• github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7third-party-advisory
• github.com/FasterXML/jackson-databind/pull/6127patchissue-tracking
• github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bdpatch