Description

jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in CoreXMLDeserializers.Std._deserialize. These deserializers are registered by default with no opt-in, so a plain ObjectMapper or JsonMapper with no polymorphic typing and no special configuration reaches this path. The XML Schema lexical grammar permits numeric components of arbitrary length, which the JDK materializes through the native BigInteger(String) and BigDecimal(String) constructors, both quadratic in digit count. Because the digits sit inside a JSON string token rather than a JSON number token, jackson-core's StreamReadConstraints.maxNumberLength guard never applies; jackson's own NumberDeserializers call validateIntegerLength or validateFPLength before parsing a stringified number, but the XML datatype deserializer omits that pre-check. An unauthenticated attacker can therefore submit a single request of a few megabytes, such as a Duration value consisting of the letter P followed by several million digits and the letter Y, and force tens of seconds to several minutes of single-threaded CPU work; a handful of concurrent requests can saturate a server's worker threads. This affects com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from 2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0 before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T16:17:39.610Z",
  "pubdate": "2026-09-11T16:17:39.610Z",
  "executiveSummary": "This vulnerability is a Denial-of-Service (DoS) flaw affecting com.fasterxml.jackson.core:jackson-databind and tools.jackson.core:jackson-databind. The issue arises from unsafe parsing of XML-specific datatypes within JSON strings, allowing an unauthenticated attacker to trigger a catastrophic CPU exhaustion event.\nBy submitting a specially crafted JSON payload containing excessively long numeric components in a Duration or XMLGregorianCalendar string, an attacker can exploit the quadratic complexity of BigInteger and BigDecimal constructors used by the underlying JDK.\nThis vulnerability is particularly dangerous because the deserializers are enabled by default and do not honor standard Jackson stream length constraints, bypassing common protections against large number attacks. Successful exploitation enables an unauthenticated attacker to induce significant latency or complete service unavailability by saturating server worker threads with compute-intensive parsing tasks. The risk is high for any application accepting untrusted JSON input that utilizes these specific XML datatypes.\nUsers are strongly advised to upgrade to the specified patched versions to ensure proper input validation and resource constraint enforcement.",
  "technicalDetails": "The vulnerability originates in the CoreXMLDeserializers.Std._deserialize method within jackson-databind. When the library encounters a JSON string targetted at a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field, it passes the raw string input directly to the DatatypeFactory methods newDuration() or newXMLGregorianCalendar().\nBecause the input is treated as a JSON string token rather than a numeric token, the standard jackson-core StreamReadConstraints.maxNumberLength guard is circumvented. Furthermore, the deserializer fails to perform the validation checks (such as validateIntegerLength or validateFPLength) that the library typically applies to other numeric types. Consequently, the input is passed directly to the JDK's XML datatype parsers, which rely on BigInteger(String) and BigDecimal(String) constructors.\nThe root cause of the performance degradation is the quadratic time complexity inherent in the underlying BigInteger and BigDecimal implementations when processing extremely long digit strings. An attacker can craft a payload starting with 'P' followed by several million digits and terminating with 'Y'. Upon ingestion, the JVM attempts to construct the datatype object, forcing a resource-intensive, single-threaded calculation that can last from several seconds to minutes.\nAttack Flow: 1. The attacker identifies an endpoint that accepts JSON input mapped to Duration or XMLGregorianCalendar fields. 2. The attacker crafts a malicious payload containing a millions-of-digits string inside the JSON field. 3. The request is transmitted over the network without requiring authentication or specific privileges. 4. Jackson-databind deserialization triggers the vulnerable path. 5. The JDK performs an expensive numeric conversion operation. 6. By sending a small volume of concurrent requests, the attacker exhausts the thread pool of the target server, leading to a complete Denial-of-Service.\nAffected versions include com.fasterxml.jackson.core:jackson-databind 2.0.0 through 2.18.9, 2.19.0 through 2.21.5, and 2.22.0 through 2.22.1; and tools.jackson.core:jackson-databind 3.0.0 through 3.1.5, and 3.2.0 through 3.2.1."
}