CVE-2026-106554

A flaw was found in jackson-dataformat-cbor. A remote attacker can supply a specially crafted Concise Binary Object Representation CBOR stream containing an excessive sequence of stacked semantic tags before a data item. Because the parser accumulates these tags without an upper bound and resizes...