CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.webauthn4j:webauthn4j-appattest (>=0.31.9.release, <=0.31.10.release) +393 more potentially affected by CVE-2026-68495 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.2.0, =1.43.1, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =0.31.9.release, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.0-rc6, =8.0.3 and more Source cves:...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1846 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.5.7 - ai.fastllm:runtime-roster3 0.5.7 - app.perawallet.xhdwalletapi:xhdwalletapi-shared 1.2.0 and more Source...

ai.tock:bot-test (>=24.9.0, <=26.3.4), ai.tock:bot-test-base (>=24.9.0, <=26.3.4) +2476 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.16.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.5, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =26.3.4 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-68495...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

EUVD-2026-90977

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. Specifically, CBORParser._decodeLongerName() decodes definite-length names without length checks, and CBORParser._decodeChunkedName() valida...

ch.rasc:wamp2spring-core (4.0.0), ch.rasc:wamp2spring-reactive (4.0.0) +703 more potentially affected by CVE-2026-68495 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.0.0, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.0.0, =6.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.1.1 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-68495...

com.amazonaws:athena-aws-cmdb (>=2026.28.1, <=2026.40.1), com.amazonaws:athena-cloudwatch (>=2026.28.1, <=2026.40.1) +196 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.22.0, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.22.0, =2.22.0, =0.11.0, =0.132.0, =0.142.0 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-684...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495: Allocation of Resources Without Limits or Throttling

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5845698176942080 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Libwebsockets vulnerabilities (USN-8822-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8822-1 advisory. It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A...

USN-8822-1 libwebsockets vulnerabilities

It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. CVE-2026-10650 It was discovered that...

USN-8822-1: Libwebsockets vulnerabilities

It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. CVE-2026-10650 It was discovered that...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5515864418615296 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

OPENSUSE-SU-2026:11878-1 jackson-dataformat-cbor-2.18.11-1.1 on GA media

These are all security issues fixed in the jackson-dataformat-cbor-2.18.11-1.1 package on the GA media of openSUSE Tumbleweed...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=4856486241828864 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...