CLEANSTART-2026-DJ12675 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the sonarqube package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CVE-2026-68496

A flaw was found in the Smile parser of jackson-dataformats-binary. The parser fails to enforce configured property name length limits when decoding object property names. A remote attacker can exploit this vulnerability by submitting a specially crafted Smile document containing an excessively...

Linux Distros Unpatched Vulnerability : CVE-2026-104895

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read,...

CLEANSTART-2026-KI58922 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the elasticsearch package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CVE-2026-104895

The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, decodeVInt computes value 25 != 0 overflow guard present in the...

CLEANSTART-2026-XU96478 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

CVE-2026-68496 affects multiple packages. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-CH00220 Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

PT-2026-122269

Security vulnerability affects the solr package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

Linux Distros Unpatched Vulnerability : CVE-2026-68496

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the...

DEBIAN-CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

UBUNTU-CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496 jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. This allows an attacker to provide a Smile document with a property name of unbounded length , causing SmileParser._handleLongFieldName() t...

CVE-2026-68496

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496 jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496 jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...

CVE-2026-68496: Allocation of Resources Without Limits or Throttling

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser.handleLongFieldName grows its internal name buffer through an...