jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or
    javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to
    DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in
    CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a
    plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this
    path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK
    materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in
    digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-
    core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call
    validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype
    deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a
    few megabytes, such as a Duration value consisting of the letter P followed by several million digits and
    the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of
    concurrent requests can saturate a server's worker threads. This affects
    com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from
    2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0
    before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-68497)

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4394-1 advisory.

    - CVE-2026-18401: Number Length Constraint Bypass in Async Parser Can Lead to Potential Processing Time     Issues       (bsc#1273856).
    - CVE-2026-68494: Async parser maxNumberLength bypass via chunked digit accumulation (bsc#1273857).
    - CVE-2026-68495: Ensure maxNameLength limit enforced for CBOR parser (bsc#1282639).
    - CVE-2026-68496: Ensure maxNameLength limit enforced for Smile parser (bsc#1282640).
    - CVE-2026-68498: Enforce maxNameLength incrementally in ReaderBasedJsonParser (bsc#1282641).
    - CVE-2026-89407: Optimize NumberInput.looksLikeValidNumber (bsc#1282645).
    - CVE-2026-89425: `UTF8DataInputJsonParser._reportInvalidToken()`lacks `maxErrorTokenLength` limit, which     allows for       unbounded `StringBuilder` growth and can lead to a DoS when malformed tokens are processed     (bsc#1282505).

    Changes for jackson-annotations:

    - Update to 2.18.11

    Changes for jackson-bom:

    - Update to 2.18.11

    Changes for jackson-core:

    - Update to 2.18.11
     * #1649: Optimize NumberInput.looksLikeValidNumber (bsc#1282645,      CVE-2026-89407)
     * #1698: UTF8DataInputJsonParser does not honor      maxErrorTokenLength when reporting an unrecognized token      (bsc#1282505, CVE-2026-89425)
     * #1642: Fix maxDocumentLength bypass in async parser      single-feedInput() case [GHSA-2c4j-63jj-9fqr]
     * #1643: Enforce maxNameLength incrementally in      ReaderBasedJsonParser (bsc#1282641, CVE-2026-68498)      of async parser (bsc#1273857, CVE-2026-68494)      non-blocking (async) parser (bsc#1273856, CVE-2026-18401)

    Changes for jackson-databind:

    - Update to 2.18.11
     * #6185: Bracket unresolved IPv6 host name in InetSocketAddress      serialization
     * #6203: Prevent unbounded growth of type id cache in      TypeDeserializer (bsc#1282491, CVE-2026-91776)
     * #6204: Avoid quadratic forward-reference resolution in      Collection/Map deserializers (bsc#1282492, CVE-2026-91777)
     * #6099: Resolve classes without initialization in      TypeFactory.findClass()
     * #6116: Reject non-ASCII digits in InetAddress literal validation
     * #6127: Add StreamReadConstraints number len constraint to      javax.xml.datatype.XMLGregorianCalendar and      javax.xml.datatype.Duration (bsc#1280125, CVE-2026-68497)
     * #6129: Limit the supported URL schemes for java.nio.file.Path      deserialization (bsc#1277883, CVE-2026-19032)
     * #6156: Add java.lang.Comparable in set of unsafe polymorphic      base types (bsc#1278008, CVE-2026-83557)
     * #6165: Apply number length limits to BigDecimal/BigInteger/      /Double/Float Map keys

    Changes for jackson-dataformat-xml:

    - Update to 2.18.11
     * Fix build to avoid past-JDK-8 bytecode generation
     * #891: Enforce StreamReadConstraints.maxNestingDepth in      FromXmlParser

    Changes for jackson-dataformats-binary:

    - Update to 2.18.11
     * #783: (protobuf) Support StreamReadConstraints.maxDocumentLength      in ProtobufParser
     * #785: (avro) Support StreamReadConstraints.maxDocumentLength and      maxTokenCount in Avro parser
     * #803: (ion) Support StreamReadConstraints.maxNestingDepth in Ion      parser (partial fix for #358)
     * #805: (ion) Support StreamReadConstraints.maxDocumentLength in      Ion parser (partial fix for #358)
     * #725: (cbor) Ensure maxNameLength limit enforced for CBOR parser      (bsc#1282639, CVE-2026-68495)
     * #726: (smile) Ensure maxNameLength limit enforced for Smile      parser (bsc#1282640, CVE-2026-68496)
     * #727: (cbor) CBORParser.nextFieldName(SerializableString)      confuses 5-bit length marker 23 with 24 ('1-byte length suffix      follows')
     * #728: (cbor) CBORParser.nextFieldName(SerializableString)      consumes Object entry slot twice on fast-path miss, truncating      definite-length Objects
     * #733: (cbor) Long `String`s not added to 'stringref' reference      table, breaking following references
     * #735: (cbor) 'stringref' property-name paths pass 5-bit length      marker instead of actual length to shouldReferenceString()
     * #736: (cbor) Long Object property names added to 'stringref'      reference table twice

    Changes for jackson-modules-base:

    - Update to 2.18.11

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1032 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2026-82433:
    getNimbusConf returned the complete daemon configuration without redaction after only a user-level     authorization check. Where the cluster is configured with them, that response includes     storm.zookeeper.auth.payload and the keystore and truststore passwords for the Thrift, Netty and ZooKeeper     TLS configuration. The UI endpoint /api/v1/cluster/configuration carried no @AuthNimbusOp annotation, so     the authorization filter treated a missing annotation as no gate required and returned immediately, so the     endpoint applied no per-user check at all and proxied the request under the UI daemon's own principal.

    CVE-2026-68497:
    jackson-databind binds a JSON string to a javax.xml.datatype.Duration or XMLGregorianCalendar field by     passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value),     bypassing jackson's stringified-number length guard and triggering quadratic CPU via BigInteger/BigDecimal     parsing; unauthenticated attacker can force minutes of single-threaded CPU work with a few-MB request.
    Affects com.fasterxml.jackson.core:jackson-databind 2.0.0 before 2.18.10, 2.19.0 before 2.21.6, 2.22.0     before 2.22.2, and tools.jackson.core 3.0.0 before 3.1.6 / 3.2.0 before 3.2.2.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or     javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to     DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in     CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a     plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this     path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK     materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in     digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-     core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call     validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype     deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a     few megabytes, such as a Duration value consisting of the letter P followed by several million digits and     the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of     concurrent requests can saturate a server's worker threads. This affects     com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from     2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-68497)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0cb401f9-9f19-11f1-a655-3497f65b111b advisory.

    The Jackson project reports:
    PolymorphicTypeValidator needs to validate generic type               parameters too     BasicPolymorphicTypeValidator setting allowIfSubTypeIsArray()               should validate element type     Add java.lang.Comparable in set of unsafe polymorphic base               types     @JsonView by-passed for @JsonUnwrapped Field/Setter               properties     @JsonView by-passed for some setterless creator               properties     @JsonView by-passed for unwrapped creator parameters     Honor @JsonView for external-type-id (EXTERNAL_PROPERTY)               properties     Renamed @JsonIgnore'd setters can deserialize via private               fields     @JsonIgnore on Record property ignored with               PropertyNamingStrategy     Case-insensitive deserialization may use wrong               @JsonIgnoreProperties     Do not allow DNS resolution when deserializing               InetAddress     Improve InetSocketAddress deserialization     Limit the supported URL schemes for java.nio.file.Path               deserialization     Add StreamReadConstraints number len constraint to               javax.xml.datatype.XMLGregorianCalendar and               javax.xml.datatype.Duration

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
458098	Echo: com.fasterxml.jackson.core:jackson-databind: security update to 2.18.10tools.jackson.core:jackson-databind: security update to 3.1.6	Tenable Cloud Security	Echo Local Security Checks	Local	high
458098	Echo: com.fasterxml.jackson.core:jackson-databind: security update to 2.18.10tools.jackson.core:jackson-databind: security update to 3.1.6	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
351412	SUSE SLED15: jackson-annotations / jackson-core / jackson-databind / etc (SUSE-SU-2026:4394-1)	Nessus	SuSE Local Security Checks	Local	high
448452	SCA: security update for com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind (GHSA-q4xh-88c3-wmh7)	Tenable Cloud Security	SCA Checks	Local	high
448452	SCA: security update for com.fasterxml.jackson.core:jackson-databind, tools.jackson.core:jackson-databind (GHSA-q4xh-88c3-wmh7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
349538	TencentOS Server 4: storm (TSSA-2026:1032)	Nessus	Tencent Local Security Checks	Local	medium
345116	Linux Distros Unpatched Vulnerability : CVE-2026-68497	Nessus	Misc.	Local	high
339070	FreeBSD : jackson-databind -- multiple vulnerabilities (0cb401f9-9f19-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-68497

high

Tenable Plugins

high

high

high

high

high

medium

high

high