jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - jackson-databind binds a JSON string to a javax.xml.datatype.Duration or     javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to     DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in     CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a     plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this     path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK     materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in     digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-     core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call     validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype     deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a     few megabytes, such as a Duration value consisting of the letter P followed by several million digits and     the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of     concurrent requests can saturate a server's worker threads. This affects     com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from     2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0     before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2. (CVE-2026-68497)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0cb401f9-9f19-11f1-a655-3497f65b111b advisory.

    The Jackson project reports:
    PolymorphicTypeValidator needs to validate generic type               parameters too     BasicPolymorphicTypeValidator setting allowIfSubTypeIsArray()               should validate element type     Add java.lang.Comparable in set of unsafe polymorphic base               types     @JsonView by-passed for @JsonUnwrapped Field/Setter               properties     @JsonView by-passed for some setterless creator               properties     @JsonView by-passed for unwrapped creator parameters     Honor @JsonView for external-type-id (EXTERNAL_PROPERTY)               properties     Renamed @JsonIgnore'd setters can deserialize via private               fields     @JsonIgnore on Record property ignored with               PropertyNamingStrategy     Case-insensitive deserialization may use wrong               @JsonIgnoreProperties     Do not allow DNS resolution when deserializing               InetAddress     Improve InetSocketAddress deserialization     Limit the supported URL schemes for java.nio.file.Path               deserialization     Add StreamReadConstraints number len constraint to               javax.xml.datatype.XMLGregorianCalendar and               javax.xml.datatype.Duration

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
345116	Linux Distros Unpatched Vulnerability : CVE-2026-68497	Nessus	Misc.	Local	high
339070	FreeBSD : jackson-databind -- multiple vulnerabilities (0cb401f9-9f19-11f1-a655-3497f65b111b)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2026-68497

high

Tenable Plugins

high

high