CLEANSTART-2026-MV46876 asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow c...

Security vulnerability affects the sonarqube package. The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check...