Security Bulletin:Vulnerability in jackson-databind may affect IBM Infosphere Change Data Capture (CVE-2026-68497)

Summary A security vulnerability has been identified in jackson-databind, General data-binding functionality for Jackson. jackson-databind is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details...

CLSA-2026-1792200854 jackson-databind: Fix of CVE-2026-68497

fix CVE-2026-68497: limit value length on Duration and XMLGregorianCalendar deserialization...

CLSA-2026-1791984617 jackson-databind: Fix of CVE-2026-68497

CVE-2026-68497: limit length of Duration and XMLGregorianCalendar string values to StreamReadConstraints maxNumberLength in CoreXMLDeserializers.Std.deserialize...

Rocky Linux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1791984617)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791984617 advisory. - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw...

AlmaLinux 9.6 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.6:CLSA-2026:1791984617)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791984617 advisory. - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw...

Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to jackson-databind (CVE-2026-19032, CVE-2026-83557 and CVE-2026-68497)

Summary IBM App Connect Enterprise Runtime is vulnerable to multiple vulnerabilities due to jackson-databind. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing t...

GHSA-Q4XH-88C3-WMH7 jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

Summary jackson-databind 3.2.1 deserializes a JSON string bound to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue / newXMLGregorianCalendarvalue. Per the XML-Schema lexical grammar these factory...

Security Bulletin: IBM Engineering Systems Design Rhapsody is vulnerable with Jackson Databind library

Summary Multiple vulnerabilities related to Jackson Databind library were addressed for IBM Engineering Systems Design Rhapsody. Vulnerability Details CVEID:CVE-2026-68497 DESCRIPTION: jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar...

com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing

A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service DoS by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar fields from JSON strings,...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the CoreXMLDeserializers.Std.deserialize path in src/main/java/com/fasterxml/jackson/databind/ext/CoreXMLDeserializers.java. An attacker can consume excessive CPU by supplying a...

Allocation of Resources Without Limits or Throttling

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the...

DEBIAN-CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

CVE-2026-68497

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

CVE-2026-68497 jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

CVE-2026-68497

CVE-2026-68497 is a CPU denial-of-service in jackson-databind caused by unbounded numeric parsing in the Duration and XMLGregorianCalendar deserializers. The XML datatype deserializer passes raw JSON strings to DatatypeFactory without the number-length pre-check used by other deserializers, and t...

CVE-2026-68497 jackson-databind: unbounded numeric parse in Duration and XMLGregorianCalendar deserialization allows CPU denial of service

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...

CVE-2026-68497: Uncontrolled Resource Consumption

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDurationvalue or newXMLGregorianCalendarvalue in CoreXMLDeserializers.Std.deserialize. These deserializers are registered...