CLEANSTART-2026-XU96478 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

CVE-2026-68496 affects multiple packages. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

Linux Distros Unpatched Vulnerability : CVE-2026-68496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0), br.com.sawcunhaos:scos-foundation-exception (>=1.0.0, <=1.1.0) +420 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.0.0-rc1, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.0.0-rc1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.42.4, =1.9.0-rc.1, =1.9.0-rc.11 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-TOOLSJACKSONDATAFORMAT-20416726...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

ai.timefold.solver:timefold-solver-migration (>=1.24.0, <=2.3.0), ch.admin.bit.jeap.openrewrite.recipe:jeap-rewrite-recipes (>=1.5.1, <=1.5.6) +953 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.19.0-rc2, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.19.0-rc2, =1.24.0, =1.5.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.59, =1.41.5, =1.43.1 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONDATAFORMAT-20416725...

ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONDATAFORMAT-20416725...

ai.timefold.solver:timefold-solver-migration (>=2.4.0-rc-1, <=2.6.0), com.buession.cas:cas-server-support-captcha (5.0.0) +190 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.22.0, =2.4.0-rc-1, =2.22.0, =2.22.0, =0.132.0, =6.4.0, =6.4.0, =6.4.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.42.0 - com.palantir.conjure.java:conjure-java-undertow-runtime...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

DEBIAN-CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

UBUNTU-CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

EUVD-2026-90978

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. This allows an attacker to provide a Smile document with a property name of unbounded length , causing SmileParser._handleLongFieldName() t...

ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...

ai.timefold.solver:timefold-solver-migration (>=1.24.0, <=2.3.0), ch.admin.bit.jeap.openrewrite.recipe:jeap-rewrite-recipes (>=1.5.1, <=1.5.6) +953 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.19.0, =1.24.0, =1.5.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.59, =1.41.5, =1.43.1 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...

ai.timefold.solver:timefold-solver-migration (>=2.4.0-rc-1, <=2.6.0), com.buession.cas:cas-server-support-captcha (5.0.0) +190 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.22.0, =2.4.0-rc-1, =2.22.0, =2.22.0, =0.132.0, =6.4.0, =6.4.0, =6.4.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.42.0 - com.palantir.conjure.java:conjure-java-undertow-runtime...