Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

EUVD-2026-90977

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...