CVE-2026-110747

ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...

CVE-2026-110747 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...

CVE-2026-110747 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...

CVE-2026-110747

The jackson-dataformat-protobuf library is vulnerable to an integer overflow in the ProtobufParser._readStringKey() method. When processing a protobuf map entry, the parser reads the length prefix of a string key into an attacker-controlled int and performs a bounds check using signed arithmetic....

CVE-2026-104895 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, decodeVInt computes value 25 != 0 overflow guard present in the...

CVE-2026-104895

The jackson-dataformat-smile library (specifically versions >=2.9.0.pr4, =3.0.0,

CVE-2026-104895 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, decodeVInt computes value 25 != 0 overflow guard present in the...

CVE-2026-104016 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

CVE-2026-104016

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

CVE-2026-104016

The jackson-dataformat-protobuf library is vulnerable to a signed integer overflow within the ProtobufParser component when processing length-prefixed protobuf string and bytes fields. Specifically, when an attacker provides a varint decoding with a length near Integer.MAX_VALUE , the arithmetic ...

CVE-2026-104016 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

ai.astraform:conformance-java (0.4.5), ai.astraform:remote-domain-author-kit-java (>=0.4.1, <=0.4.4) +1005 more potentially affected by CVE-2026-115876 via tools.jackson.dataformat:jackson-dataformat-yaml (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-yaml MAVEN version =3.2.0, =0.4.1, =0.3.0, =0.4.1, =1.4.0, =1.4.0, =3.10.0-rc1-bin-20260730-ae2ed95-nightly, =4.5.0, =4.5.0, =2.3.6-fx4, =2.3.6-fx5 and more Source cves: CVE-2026-115876 Source advisory: MEND:CVE-2026-115876...

CVE-2026-115876

Summary "YAMLAnchorReplayingParser" in "jackson-dataformat-yaml" available since 2.19.0 handles YAML merge keys "" through unbounded recursion. A crafted YAML document with approximately 3,271 levels of nested "" keys 20 KB triggers "StackOverflowError" on the parsing thread. Because...

ai.pipestream.module:module-chunker (>=0.1.4, <=0.1.5), ai.pipestream.module:module-echo (0.1.4) +2528 more potentially affected by CVE-2026-115876 via com.fasterxml.jackson.dataformat:jackson-dataformat-yaml (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-yaml MAVEN version =2.22.0, =0.1.4, =0.3.0, =0.1.2, =0.1.4, =0.7.30, =0.7.30, =0.7.41 and more Source cves: CVE-2026-115876 Source advisory: MEND:CVE-2026-115876...

ai.astraform:remote-domain-conformance-java (0.2.0), ai.chatur:cortex-spring-boot-autoconfigure (>=0.0.1, <=0.1.4) +2181 more potentially affected by CVE-2026-115876 via tools.jackson.dataformat:jackson-dataformat-yaml (>=3.1.0, <=3.1.5)

tools.jackson.dataformat:jackson-dataformat-yaml MAVEN version =3.1.0, =0.0.1, =0.1.0, =0.9.3, =0.9.4, =0.9.7, =0.9.3, =0.9.9, =0.9.6, =0.9.3, =0.9.3, =0.9.9, =0.9.3, =0.9.3, =1.0.0-beta.1, =1.0.0-beta.8 and more Source cves: CVE-2026-115876 Source advisory: MEND:CVE-2026-115876...

ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-metrics (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +11430 more potentially affected by CVE-2026-115876 via com.fasterxml.jackson.dataformat:jackson-dataformat-yaml (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-yaml MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.4.0, =0.0.2, =0.0.2, =0.8.4 and more...

Security Bulletin:Vulnerability in jackson-dataformat-cbor may affect IBM Infosphere Change Data Capture (CVE-2026-68495)

Summary A security vulnerability has been identified in jackson-dataformat-cbor, . is used by IBM Infosphere Change Data Capture. IBM has addressed this vulnerability. Refer to the "Remediation/Fixes" section below for remediation details. Vulnerability Details CVEID:CVE-2026-68495 DESCRIPTION: T...

ch.rasc:wamp2spring-core (4.0.1), ch.rasc:wamp2spring-reactive (4.0.1) +419 more potentially affected by CVE-2026-106554 via tools.jackson.dataformat:jackson-dataformat-cbor (>=3.2.0, <=3.2.3)

tools.jackson.dataformat:jackson-dataformat-cbor MAVEN version =3.2.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.1 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-106554...

ai.tock:bot-test (>=24.9.0, <=26.3.4), ai.tock:bot-test-base (>=24.9.0, <=26.3.4) +3092 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.15.0-rc1, <=2.18.11)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.15.0-rc1, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.5, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =24.9.0, =26.3.4 and more Source cves: CVE-2026-106554 Source advisory:...

ai.badmonkey.agentspaces:agentspaces-a2a (>=0.2.0, <=0.4.0), ai.badmonkey.agentspaces:agentspaces-agent (>=0.2.0, <=0.4.0) +1947 more potentially affected by CVE-2026-106554 via com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (>=2.19.0-rc2, <=2.21.7)

com.fasterxml.jackson.dataformat:jackson-dataformat-cbor MAVEN version =2.19.0-rc2, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.3.0, =0.4.0 and more Source cves: CVE-2026-106554 Source advisory: MEND:CVE-2026-106554...