Lucene search
+L

2 matches found

Github Security Blog
Github Security Blog
•added 2026/09/28 8:19 p.m.•11 views

jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

Summary jackson-databind 3.2.1 deserializes a JSON string bound to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue / newXMLGregorianCalendarvalue. Per the XML-Schema lexical grammar these factory...

7.5CVSS5.9AI score0.00581EPSS
SaveExploits0References10Affected Software2
SUSE CVE
SUSE CVE
•added 2026/09/15 1:33 a.m.•2 views

SUSE CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

7.5CVSS6AI score0.00581EPSS
SaveExploits0References3
Rows per page
Query Builder