https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:16:15 +0000 https://vulnerability.circl.lu/sighting/220ac67f-237f-4b14-8a95-81d4d87a9ac1/export {"uuid": "220ac67f-237f-4b14-8a95-81d4d87a9ac1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68497", "type": "seen", "source": "https://gist.github.com/alon710/ba9af252a5cf5e2fb0711c5a377b3eb2", "content": "# CVE-2026-68497: CVE-2026-68497: CPU Denial of Service via XML Datatype Deserialization in FasterXML jackson-databind\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68497\n\n## Summary\nCVE-2026-68497 is a high-severity CPU Denial of Service (DoS) vulnerability in jackson-databind. It arises because the library bypasses default input constraint checks when parsing stringified XML datatypes, subsequently passing arbitrary-length inputs to JDK constructors with quadratic execution complexity.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust server CPU resources and trigger a total Denial of Service by submitting crafted JSON payloads containing extremely long XML Duration or XMLGregorianCalendar strings.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-1333\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Applications utilizing FasterXML jackson-databind for parsing JSON payloads into javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar Java types.\n- Web services and APIs built on Java-based frameworks (such as Spring Boot, Quarkus, Micronaut, and JAX-RS) incorporating vulnerable Jackson versions.\n- **jackson-databind**: >= 2.0.0, < 2.18.10 (Fixed in: `2.18.10`)\n- **jackson-databind**: >= 2.19.0, < 2.21.6 (Fixed in: `2.21.6`)\n- **jackson-databind**: >= 2.22.0, < 2.22.2 (Fixed in: `2.22.2`)\n- **jackson-databind**: >= 3.0.0, < 3.1.6 (Fixed in: `3.1.6`)\n- **jackson-databind**: >= 3.2.0, < 3.2.2 (Fixed in: `3.2.2`)\n\n## Mitigation\n\n- Upgrade FasterXML jackson-databind to a patched release version (2.18.10+, 2.21.6+, 2.22.2+, 3.1.6+, or 3.2.2+).\n- Deploy Web Application Firewall (WAF) or API Gateway rules to restrict the maximum HTTP POST request body size to prevent massive payload delivery.\n- Refactor target Java models to bind XML fields as standard Strings, manually validating input lengths before processing.\n\n**Remediation Steps:**\n1. Audit application dependency trees to identify vulnerable instances of com.fasterxml.jackson.core:jackson-databind.\n2. Update build configuration files (e.g., pom.xml or build.gradle) to enforce the use of a secure, patched version of Jackson.\n3. Deploy the updated application to staging environments and run integration tests to verify the compatibility of the patched library.\n4. Apply payload size limit restrictions on edge proxy servers (such as Nginx, HAProxy, or AWS ALB) as an immediate defense-in-depth measure.\n\n## References\n\n- [Authoritative CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-68497)\n- [GitHub Advisory Database (GHSA-q4xh-88c3-wmh7)](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7)\n- [GitHub Patch Commit](https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd)\n- [GitHub Pull Request #6127](https://github.com/FasterXML/jackson-databind/pull/6127)\n- [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-68497)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68497) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T08:30:29.000000Z"} {"uuid": "220ac67f-237f-4b14-8a95-81d4d87a9ac1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-68497", "type": "seen", "source": "https://gist.github.com/alon710/ba9af252a5cf5e2fb0711c5a377b3eb2", "content": "# CVE-2026-68497: CVE-2026-68497: CPU Denial of Service via XML Datatype Deserialization in FasterXML jackson-databind\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-68497\n\n## Summary\nCVE-2026-68497 is a high-severity CPU Denial of Service (DoS) vulnerability in jackson-databind. It arises because the library bypasses default input constraint checks when parsing stringified XML datatypes, subsequently passing arbitrary-length inputs to JDK constructors with quadratic execution complexity.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust server CPU resources and trigger a total Denial of Service by submitting crafted JSON payloads containing extremely long XML Duration or XMLGregorianCalendar strings.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-1333\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- Applications utilizing FasterXML jackson-databind for parsing JSON payloads into javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar Java types.\n- Web services and APIs built on Java-based frameworks (such as Spring Boot, Quarkus, Micronaut, and JAX-RS) incorporating vulnerable Jackson versions.\n- **jackson-databind**: >= 2.0.0, < 2.18.10 (Fixed in: `2.18.10`)\n- **jackson-databind**: >= 2.19.0, < 2.21.6 (Fixed in: `2.21.6`)\n- **jackson-databind**: >= 2.22.0, < 2.22.2 (Fixed in: `2.22.2`)\n- **jackson-databind**: >= 3.0.0, < 3.1.6 (Fixed in: `3.1.6`)\n- **jackson-databind**: >= 3.2.0, < 3.2.2 (Fixed in: `3.2.2`)\n\n## Mitigation\n\n- Upgrade FasterXML jackson-databind to a patched release version (2.18.10+, 2.21.6+, 2.22.2+, 3.1.6+, or 3.2.2+).\n- Deploy Web Application Firewall (WAF) or API Gateway rules to restrict the maximum HTTP POST request body size to prevent massive payload delivery.\n- Refactor target Java models to bind XML fields as standard Strings, manually validating input lengths before processing.\n\n**Remediation Steps:**\n1. Audit application dependency trees to identify vulnerable instances of com.fasterxml.jackson.core:jackson-databind.\n2. Update build configuration files (e.g., pom.xml or build.gradle) to enforce the use of a secure, patched version of Jackson.\n3. Deploy the updated application to staging environments and run integration tests to verify the compatibility of the patched library.\n4. Apply payload size limit restrictions on edge proxy servers (such as Nginx, HAProxy, or AWS ALB) as an immediate defense-in-depth measure.\n\n## References\n\n- [Authoritative CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-68497)\n- [GitHub Advisory Database (GHSA-q4xh-88c3-wmh7)](https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7)\n- [GitHub Patch Commit](https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd)\n- [GitHub Pull Request #6127](https://github.com/FasterXML/jackson-databind/pull/6127)\n- [National Vulnerability Database (NVD)](https://nvd.nist.gov/vuln/detail/CVE-2026-68497)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-68497) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T08:30:29.000000Z"} https://vulnerability.circl.lu/sighting/220ac67f-237f-4b14-8a95-81d4d87a9ac1/export Tue, 29 Sep 2026 08:30:29 +0000 https://vulnerability.circl.lu/sighting/99b6b644-404e-4baa-a206-f4a38390f8aa/export {"uuid": "99b6b644-404e-4baa-a206-f4a38390f8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68497", "type": "published-proof-of-concept", "source": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7", "content": "", "creation_timestamp": "2026-08-21T18:25:33.000000Z"} {"uuid": "99b6b644-404e-4baa-a206-f4a38390f8aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-68497", "type": "published-proof-of-concept", "source": "https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7", "content": "", "creation_timestamp": "2026-08-21T18:25:33.000000Z"} https://vulnerability.circl.lu/sighting/99b6b644-404e-4baa-a206-f4a38390f8aa/export Fri, 21 Aug 2026 18:25:33 +0000