CVE-2026-104016

🗓️ 20 Oct 2026 00:00:00Reported by MendType

Signed-int overflow in jackson-dataformat-protobuf string-length paths leads to DoS.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-104016	27 Oct 202623:58	–	circl
CVE	CVE-2026-104016	27 Oct 202623:52	–	cve
Cvelist	CVE-2026-104016 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError	27 Oct 202623:52	–	cvelist
EUVD	EUVD-2026-111529	27 Oct 202623:52	–	euvd
NVD	CVE-2026-104016	28 Oct 202600:17	–	nvd
Positive Technologies	PT-2026-127308	27 Oct 202600:00	–	ptsecurity
vulnersOsv	com.hazelcast.jsurfer:jsurfer-all (0.13), org.apache.camel.springboot:camel-jackson3-protobuf-starter (>=4.19.0, <=4.23.0) +10 more potentially affected by CVE-2026-104016 via tools.jackson.dataformat:jackson-dataformat-protobuf (>=3.0.3, <=3.1.5)	20 Oct 202600:00	–	vulnersosv
vulnersOsv	com.github.jsurfer:jsurfer-all (>=1.4.3, <=1.6.5), com.github.squirrelgrip:kotlin-extensions (>=1.3.9, <=1.3.12) +170 more potentially affected by CVE-2026-104016 via com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf (>=2.7.2, <=2.18.5)	20 Oct 202600:00	–	vulnersosv
vulnersOsv	org.apache.camel:camel-jackson3-protobuf (>=4.21.0, <=4.23.0), org.projectnessie.cel:cel-jackson3 (>=0.6.2, <=0.8.0) potentially affected by CVE-2026-104016 via tools.jackson.dataformat:jackson-dataformat-protobuf (>=3.2.0, <=3.2.3)	20 Oct 202600:00	–	vulnersosv
vulnersOsv	org.apache.camel.quarkus:camel-quarkus-integration-test-jackson-protobuf (>=3.38.0, <=3.40.0), org.apache.camel.quarkus:camel-quarkus-jackson-protobuf (>=3.38.0, <=3.40.0) +18 more potentially affected by CVE-2026-104016 via com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf (>=2.22.0, <=2.22.3)	20 Oct 202600:00	–	vulnersosv