CLEANSTART-2026-OF13352 jackson-databind binds a JSON string to a javax

🗓️ 01 Oct 2026 00:35:40Reported by GoogleType

osv🔗 osv.dev

Security vulnerability in apache-nifi jackson-databind binds a JSON string to a library.

Reporter	Title	Published	Views	Family All 1000
FreeBSD	jackson-databind -- multiple vulnerabilities	28 May 202600:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)	29 Sep 202606:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library	28 Sep 202606:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Manage application in IBM Maximo Application Suite uses jackson-databind-2.18.9.jar and httpclient5-5.3.1.jar and is vulnerable to CVE-2026-19032, CVE-2026-83557, CVE-2026-68497 and CVE-2026-64607	1 Oct 202610:01	–	ibm
Chainguard	CVE-2026-68497 vulnerabilities	29 Sep 202620:54	–	cgr
Circl	CVE-2026-68497	21 Aug 202618:25	–	circl
CVE	CVE-2026-68497	11 Sep 202615:49	–	cve
Cvelist	CVE-2026-68497 jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service	11 Sep 202615:49	–	cvelist
Debian CVE	CVE-2026-68497	11 Sep 202615:49	–	debiancve
EUVD	EUVD-2026-76142	28 Sep 202620:19	–	euvd

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-OF13352.json
osv	www.osv.dev/vulnerability/CVE-2026-68497
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-68497

01 Oct 2026 03:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00581

apache-nifi jackson-databind library