com.amazonaws:athena-aws-cmdb (>=2026.28.1, <=2026.40.1), com.amazonaws:athena-cloudwatch (>=2026.28.1, <=2026.40.1) +196 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.22.0, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2026.28.1, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.4.0, =2.22.0, =2.22.0, =0.11.0, =0.132.0, =0.142.0 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-684...

ai.fastllm:agent-bridge_3 (>=0.3.0, <=0.5.7), ai.fastllm:agent-checkpoint-git_3 (>=0.3.0, <=0.5.7) +1836 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.5.7 - ai.fastllm:runtime-roster3 0.5.7 - app.perawallet.xhdwalletapi:xhdwalletapi-shared 1.2.0 and more Source...

ai.tock:bot-test (>=24.9.0, <=26.3.4), ai.tock:bot-test-base (>=24.9.0, <=26.3.4) +2473 more potentially affected by CVE-2026-68495 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.16.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.5, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =26.3.4 and more Source cves: CVE-2026-68495 Source advisory: MEND:CVE-2026-68495...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary fails to invoke StreamReadConstraints.validateNameLength() when decoding JSON object property names. Specifically, CBORParser._decodeLongerName() decodes definite-length names without length checks, and CBORParser._decodeChunkedName() valida...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495 jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

EUVD-2026-90977

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-68495: Allocation of Resources Without Limits or Throttling

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5845698176942080 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Libwebsockets vulnerabilities (USN-8822-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8822-1 advisory. It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A...

USN-8822-1 libwebsockets vulnerabilities

It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. CVE-2026-10650 It was discovered that...

USN-8822-1: Libwebsockets vulnerabilities

It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. CVE-2026-10650 It was discovered that...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5515864418615296 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

OPENSUSE-SU-2026:11878-1 jackson-dataformat-cbor-2.18.11-1.1 on GA media

These are all security issues fixed in the jackson-dataformat-cbor-2.18.11-1.1 package on the GA media of openSUSE Tumbleweed...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=4856486241828864 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

SUSE CVE-2026-68495

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser.decodeLongerName decodes a definite-length property name with no length...

CVE-2026-61554 emp3r0r has an unauthenticated HTTP Polling DoS

emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the httppoll C2 transport accepts attacker-controlled HTTP polling sessions before CBOR MsgAuth authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send...

Astra Linux – Vulnerability in Wireshark

The CBOR dissector crash in Wireshark versions 4.0.0 to 4.0.6 allows for denial of service through packet injection or malicious capture files...