Denial of Service Vulnerability in Jackson Databind by FasterXML
CVE-2026-68497

7.5HIGH

Key Information:

Vendor

Fasterxml

Status
Jackson-databind
Vendor
CVE Published:
11 September 2026

What is CVE-2026-68497?

A denial of service vulnerability exists in the Jackson Databind library where unauthenticated attackers can exploit weak deserialization handling of certain XML data types. By sending specially crafted JSON strings with large numeric values, attackers can cause significant CPU resource consumption on the server, delaying or disrupting service. Affected users are advised to update to secure versions to mitigate this risk.

Affected Version(s)

jackson-databind 2.0.0 < 2.18.10

jackson-databind 2.19.0 < 2.21.6

jackson-databind 2.22.0 < 2.22.2

References

https://github.com/FasterXML/jackson-databind/security/ad...
third-party-advisory
https://github.com/FasterXML/jackson-databind/pull/6127
patchissue-tracking
https://github.com/FasterXML/jackson-databind/commit/a99b...
patch

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

waydeshi
pjfanning
.