CLEANSTART-2026-OQ29524 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

CVE-2026-68495 affects multiple packages. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-XU96478 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

CVE-2026-68496 affects multiple packages. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CLEANSTART-2026-AR08566 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

Linux Distros Unpatched Vulnerability : CVE-2026-68496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

UBUNTU-CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. This allows an attacker to provide a Smile document with a property name of unbounded length , causing SmileParser._handleLongFieldName() t...

CVE-2026-68496 jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

EUVD-2026-90977

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. Specifically, CBORParser._decodeLongerName() decodes definite-length names without length checks, and CBORParser._decodeChunkedName() valida...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495: Allocation of Resources Without Limits or Throttling

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

SUSE CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

Security Bulletin: Jackson-Dataformats Vulnerability Affects the B2B API of IBM Sterling B2B Integrator (CVE-2020-28491)

Summary IBM Sterling B2B Integrator has addressed the security vulnerability Vulnerability Details CVEID: CVE-2020-28491 DESCRIPTION: FasterXML jackson-dataformats-binary is vulnerable to a denial of service, caused by an unchecked allocation of byte buffer flaw. By sending a specially-crafted...