Allocation of Resources Without Limits or Throttling

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the CoreXMLDeserializers.Std.deserialize path in src/main/java/com/fasterxml/jackson/databind/ext/CoreXMLDeserializers.java. An attacker can consume excessive CPU by supplying a...

CVE-2026-68497: Uncontrolled Resource Consumption

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...