wolfCOSE

wolfCOSE wolfCOSE is a lightweight and fast C library implementing core CBOR and COSE standards, backed by wolfSSL for cryptography. Supported Standards & RFCs Core Specifications: RFC 8949 - Concise Binary Object Representation CBOR RFC 9052 - CBOR Object Signing and Encryption COSE RFC 9053 -...

CLEANSTART-2026-CZ74700 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the sonarqube package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

Microsoft Security Advisory CVE-2026-118747 - .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Colliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing...

CVE-2026-118747

Colliding CBOR map keys can hash-flood uniqueness checks; the fix uses seeded Marvin hashing...

PT-2026-143809

Name of the Vulnerable Software and Affected Versions System.Formats.Cbor versions 8.0.0-0 through 8.0.1 System.Formats.Cbor versions 9.0.0-0 through 9.0.23 System.Formats.Cbor versions 10.0.0-0 through 10.0.14 System.Formats.Cbor versions prior to 11.0.0 Description Inefficient algorithmic...

[SECURITY] Fedora 44 Update: jackson-jaxrs-providers-2.18.12-1.fc44

This is a multi-module project that contains Jackson-based JAX-RS providers f or following data formats: JSON, Smile binary JSON, XML, CBOR another kind of binary JSON, YAML...

CVE-2026-106554

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

CVE-2026-106554

A flaw was found in jackson-dataformat-cbor. A remote attacker can supply a specially crafted Concise Binary Object Representation CBOR stream containing an excessive sequence of stacked semantic tags before a data item. Because the parser accumulates these tags without an upper bound and resizes...

CVE-2026-68495

A flaw was found in jackson-dataformat-cbor. The parser fails to enforce maximum property name length limits when decoding Concise Binary Object Representation CBOR documents. A remote attacker can exploit this vulnerability by submitting a crafted CBOR document containing an excessively long...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the TagList.add method in CBORParser. An attacker can send a CBOR value preceded by a long run of tags, causing repeated fixed-increment array growth and copying that consumes quadratic CPU and...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the TagList.add method in CBORParser. An attacker can send a CBOR value preceded by a long run of tags, causing repeated fixed-increment array growth and copying that consumes quadratic CPU and...

DEBIAN-CVE-2026-106554

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

CVE-2026-106554

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

ch.rasc:wamp2spring-core (4.0.1), ch.rasc:wamp2spring-reactive (4.0.1) +419 more potentially affected by CVE-2026-106554 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.2.0, <=3.2.3)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.2.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.1 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-106554...

CVE-2026-106554 jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

CVE-2026-106554 jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth CPU/GC-exhaustion DoS, PoC-proven. PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x...

ai.badmonkey.agentspaces:agentspaces-a2a (>=0.2.0, <=0.5.0), ai.badmonkey.agentspaces:agentspaces-agent (>=0.2.0, <=0.5.0) +1972 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0-rc2, <=2.21.7)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0-rc2, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.4.0, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =0.2.0, =0.5.0 and more Source cves: CVE-2026-106554 Source advisory:...

ai.tock:tock-nlp-build-model-worker (>=26.9.0, <=26.9.1), ai.tock:tock-nlp-build-model-worker-on-aws-batch (>=26.9.0, <=26.9.1) +266 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.22.0, <=2.22.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.22.0, =26.9.0, =26.9.0, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.22.0, =2.22.0, =2.22.3 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-1065...

ch.rasc:wamp2spring-core (4.0.0), ch.rasc:wamp2spring-reactive (4.0.0) +707 more potentially affected by CVE-2026-106554 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.0.0-rc1, <=3.1.7)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.0.0-rc1, =6.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.0.1, =4.1.2.0 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-106554...

ai.tock:bot-test (>=24.9.0, <=26.3.4), ai.tock:bot-test-base (>=24.9.0, <=26.3.4) +3092 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.15.0-rc1, <=2.18.11)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.15.0-rc1, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.5, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =26.3.4 and more Source cves: CVE-2026-106554 Source advisory:...