Hi,

The following vulnerability was published for jackson-databind.

CVE-2026-68497[0]:
| jackson-databind binds a JSON string to a
| javax.xml.datatype.Duration or
| javax.xml.datatype.XMLGregorianCalendar field by passing the raw
| string verbatim to DatatypeFactory.newDuration(value) or
| newXMLGregorianCalendar(value) in
| CoreXMLDeserializers.Std._deserialize. These deserializers are
| registered by default with no opt-in, so a plain ObjectMapper or
| JsonMapper with no polymorphic typing and no special configuration
| reaches this path. The XML Schema lexical grammar permits numeric
| components of arbitrary length, which the JDK materializes through
| the native BigInteger(String) and BigDecimal(String) constructors,
| both quadratic in digit count. Because the digits sit inside a JSON
| string token rather than a JSON number token, jackson-core's
| StreamReadConstraints.maxNumberLength guard never applies; jackson's
| own NumberDeserializers call validateIntegerLength or
| validateFPLength before parsing a stringified number, but the XML
| datatype deserializer omits that pre-check. An unauthenticated
| attacker can therefore submit a single request of a few megabytes,
| such as a Duration value consisting of the letter P followed by
| several million digits and the letter Y, and force tens of seconds
| to several minutes of single-threaded CPU work; a handful of
| concurrent requests can saturate a server's worker threads. This
| affects com.fasterxml.jackson.core:jackson-databind from 2.0.0
| before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before
| 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before
| 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10,
| 2.21.6, 2.22.2, 3.1.6, or 3.2.2.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-68497
https://www.cve.org/CVERecord?id=CVE-2026-68497
[1] https://github.com/FasterXML/jackson-databind/pull/6127
[2] https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7
[3] https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
jackson-databind, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147507@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated jackson-databind package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 15 Oct 2026 09:28:11 +0200
Source: jackson-databind
Architecture: source
Version: 2.18.11-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers <pkg-java-maintainers@lists.alioth.debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 1145887 1146640 1147507
Changes:
 jackson-databind (2.18.11-1) unstable; urgency=medium
 .
   * Team upload.
   * New upstream release
     - Fixes CVE-2026-54512, CVE-2026-54513, CVE-2026-54514 and CVE-2026-54515
       (Closes: #1145887)
     - Fixes CVE-2026-83557: Comparable was missing from the unsafe base
       types of DefaultBaseTypeLimitingValidator (Closes: #1146640)
     - Fixes CVE-2026-68497: the XML datatype deserializers did not bound
       the length of stringified numbers (Closes: #1147507)
     - Updated the Maven rules
     - Removed the patches, no longer needed
     - Tightened the dependencies on jackson-core and jackson-annotations
   * Converted debian/watch to the version 5 format
Checksums-Sha1:
 ba3831fa45c2dbf1ef1667d067ed5e1ab4603a50 2427 jackson-databind_2.18.11-1.dsc
 4e114dbb08c9b92c162ced5a1d7a84d7633a7bd8 1170644 jackson-databind_2.18.11.orig.tar.xz
 f18d3c14478cad2d79000c1d9b4007e6c259a05d 7804 jackson-databind_2.18.11-1.debian.tar.xz
 dcb098e82e26b554b2e8ead1d8f1c76d573c3cc0 20099 jackson-databind_2.18.11-1_source.buildinfo
Checksums-Sha256:
 0b0c8dc995a1cf78b19a68650dab0f160608f3b420e7d8a9a9ce0a1c8724da23 2427 jackson-databind_2.18.11-1.dsc
 7953119f3ebf50c226fdb8fbe88455b193584ceefb7cd9454ab1a6695d231628 1170644 jackson-databind_2.18.11.orig.tar.xz
 19356d3a80146bc1b19aa6d5a5afa2e6dfb924891253cbf6de22715a54628648 7804 jackson-databind_2.18.11-1.debian.tar.xz
 c4fe24ba350344e2dbfefa6442cc4978884bce9f3f9564790a0e0ab972410eb4 20099 jackson-databind_2.18.11-1_source.buildinfo
Files:
 d514eb00bf94bd721b73ce68c12a6c96 2427 java optional jackson-databind_2.18.11-1.dsc
 057a642aa2a319add0ea4f864e08b321 1170644 java optional jackson-databind_2.18.11.orig.tar.xz
 108ff1d3cc42a393aa75c88aee0e9f2c 7804 java optional jackson-databind_2.18.11-1.debian.tar.xz
 a73e70765d2dbae7d6e1023de3c20547 20099 java optional jackson-databind_2.18.11-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrQzG4SHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsDFIQAJTLxLe2bJjhQa0NS/Lj/8LOMzuGXD6x
lPmxacmX3pjqevjiK/SWuE62Q7c0hZnGDNwl2don0V7rLcHmU3R/x5LHcpMC1i6e
6tlmdPuQMgRShionp71/r649DvaCrT9c2cixTEJnwgODsEjR9Qu0+bfEz0LMS0P/
BF9eZ3KathkaPARxWCbeNTBV+6eAd3jE+GjutaAOI5B14Ne03camT3gLADXtecjf
352CVv4lNCMBB1ehzdOq5l43qjYvIiBPf7JY262pBsY17tyuu9nFuPfswowXQNky
15t30OfGrHjsY99VWa3a0CNYNKck1ilKey7UMW/tNEGw7PuW1voshi3UeDC08gO8
Mcujiw56qGHxlhciGjXJ9e7GUOA3QnVrQgorpB1Co4CoBefhQsVOfMg1NLv5nrXS
78Edig/J6NHXi5Q+8xRnBL3eYVXaioIzO2VdadNKmDEAxU3ooBX52MRQ9k31WAhn
CqtYc+TNeH5CPqWL40zaYIuSC02ni2DMmoeee8ewE5jEmyA0jrz14BBOJfP1gLnW
8fOln1h9D6IYUdDXCaOfglKAumlUP+QCcivgLogTtQx7kIooOdjmEFmf5vL0biJA
ZQ8GeY5aIaQneP0d8JPZXkWOuvAxlSfHhK8bI7e+4ssuCLwqlKP4+k4WuOwi2eMj
vL8c01hft3zz
=Ir20
-----END PGP SIGNATURE-----