VDB
RHSA-2026:80504
RHSA-2026:80504
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in jackson-databind. An unauthenticated attacker can trigger a denial of service (DoS) by exploiting an unbounded numeric parse vulnerability. This occurs during the deserialization of `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` fields from JSON strings, where the system processes arbitrarily long numeric components. This can lead to high CPU utilization, potentially saturating server worker threads and making the service unavailable.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | jackson-core-0:2.21.6-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | pki-jackson-jaxrs-providers-0:2.21.6-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | jackson-modules-base-0:2.21.6-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | pki-jackson-core-0:2.21.6-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | pki-jackson-jaxrs-json-provider-0:2.21.6-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | jackson-databind-0:2.21.6-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | pki-jackson-module-jaxb-annotations-0:2.21.6-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | jackson-jaxrs-providers-0:2.21.6-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
| Red Hat | pki-jackson-databind-0:2.21.6-1.el9_8.noarch as a component of Red Hat Enterprise Linux AppStream (v. 9) | 0:2.21.6-1.el9_8 |
Timeline
- Oct 12, 2026 CVE Published
- Oct 21, 2026 CVE Updated
- Oct 21, 2026 Distribution Patch
- Oct 21, 2026 Distribution Patch
- Oct 21, 2026 Security Advisory
- Oct 21, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:80504 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2531964 issue
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80504.json advisory
- https://access.redhat.com/security/cve/CVE-2026-68497 advisory
- https://www.cve.org/CVERecord?id=CVE-2026-68497 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-68497 advisory
- https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd advisory
- https://github.com/FasterXML/jackson-databind/pull/6127 advisory
- https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7 advisory