CVE-2026-106554

The jackson-dataformat-cbor module in jackson-dataformats-binary is vulnerable to an algorithmic-complexity denial of service (CWE-407) . An attacker can exploit an unbounded run of CBOR tags in the CBORParser.java file; because the TagList backing array grows by a fixed increment (+8) instead of...

CVE-2026-106554: FasterXML jackson-dataformat-cbor: One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time…

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

CVE-2026-106554

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...