jackson-core-2.21.6-1.el9_8, jackson-databind-2.21.6-1.el9_8, jackson-jaxrs-providers-2.21.6-1.el9_8, jackson-modules-base-2.21.6-1.el9_8

This is a multi-module project that contains Jackson-based JAX-RS providers for
following data formats: JSON, Smile (binary JSON), XML, CBOR (another kind of
binary JSON), YAML.

Security Fix(es):

* com.fasterxml.jackson.core/jackson-databind:
tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via
unbounded numeric parsing (CVE-2026-68497)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2026-68497
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or
javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim
to DatatypeFactory.newDuration(value) or newXMLGregorianCalendar(value) in
CoreXMLDeserializers.Std._deserialize. These deserializers are registered by
default with no opt-in, so a plain ObjectMapper or JsonMapper with no
polymorphic typing and no special configuration reaches this path. The XML
Schema lexical grammar permits numeric components of arbitrary length, which the
JDK materializes through the native BigInteger(String) and BigDecimal(String)
constructors, both quadratic in digit count. Because the digits sit inside a
JSON string token rather than a JSON number token, jackson-core's
StreamReadConstraints.maxNumberLength guard never applies; jackson's own
NumberDeserializers call validateIntegerLength or validateFPLength before
parsing a stringified number, but the XML datatype deserializer omits that
pre-check. An unauthenticated attacker can therefore submit a single request of
a few megabytes, such as a Duration value consisting of the letter P followed by
several million digits and the letter Y, and force tens of seconds to several
minutes of single-threaded CPU work; a handful of concurrent requests can
saturate a server's worker threads. This affects
com.fasterxml.jackson.core:jackson-databind from 2.0.0 before 2.18.10, from
2.19.0 before 2.21.6, and from 2.22.0 before 2.22.2, and
tools.jackson.core:jackson-databind from 3.0.0 before 3.1.6 and from 3.2.0
before 3.2.2. Users should upgrade to 2.18.10, 2.21.6, 2.22.2, 3.1.6, or 3.2.2.