CVE-2026-104895 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, decodeVInt computes value 25 != 0 overflow guard present in the...

CVE-2026-104895 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, decodeVInt computes value 25 != 0 overflow guard present in the...

CVE-2026-104895

The jackson-dataformat-smile library (specifically versions >=2.9.0.pr4, =3.0.0,

ai.timefold.solver:timefold-solver-migration (>=0.8.38, <=1.23.0), ai.ylyue:yue-library-data-es (>=j8.2.2.0, <=j11.2.6.2) +3041 more potentially affected by CVE-2026-104895 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.9.0.pr4, <=2.18.11)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.9.0.pr4, =0.8.38, =j8.2.2.0, =5.3.0, =5.6.5, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =6.2.0, =6.8.0, =6.4.0, =5.3.0, =5.3.0, =5.3.0, =5.3.0, =6.10.5 and more Source cves: CVE-2026-104895 Source advisory: MEND:CVE-2026-104895...

ch.rasc:wamp2spring-core (4.0.1), ch.rasc:wamp2spring-reactive (4.0.1) +492 more potentially affected by CVE-2026-104895 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.3)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.22 and more Source cves: CVE-2026-104895 Source advisory: MEND:CVE-2026-104895...

ai.timefold.solver:timefold-solver-migration (>=1.24.0, <=2.8.0-rc-1), ch.admin.bit.jeap.openrewrite.recipe:jeap-rewrite-recipes (>=1.5.1, <=1.5.6) +971 more potentially affected by CVE-2026-104895 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.19.0, <=2.21.7)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.19.0, =1.24.0, =1.5.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.59, =1.41.5, =1.43.1 and more Source cves: CVE-2026-104895 Source advisory: MEND:CVE-2026-104895...

ai.timefold.solver:timefold-solver-migration (>=2.4.0-rc-1, <=2.7.1), ch.admin.bit.jeap.openrewrite.recipe:jeap-rewrite-recipes (>=2.0.0, <=4.4.0) +242 more potentially affected by CVE-2026-104895 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.22.0, <=2.22.3)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.22.0, =2.4.0-rc-1, =2.0.0, =2.22.0, =2.22.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =2.1.0, =1.2.7, =0.0.6, =0.1.1, =1.1.1, =1.3.1 and more Source cves: CVE-2026-104895 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

ai.timefold.solver:timefold-solver-migration (>=1.24.0, <=2.3.0), ch.admin.bit.jeap.openrewrite.recipe:jeap-rewrite-recipes (>=1.5.1, <=1.5.6) +953 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.19.0-rc2, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.19.0-rc2, =1.24.0, =1.5.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.59, =1.41.5, =1.43.1 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONDATAFORMAT-20416725...

ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONDATAFORMAT-20416725...

ai.timefold.solver:timefold-solver-migration (>=2.4.0-rc-1, <=2.6.0), com.buession.cas:cas-server-support-captcha (5.0.0) +190 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.22.0, =2.4.0-rc-1, =2.22.0, =2.22.0, =0.132.0, =6.4.0, =6.4.0, =6.4.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.42.0 - com.palantir.conjure.java:conjure-java-undertow-runtime...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in CBORParser.decodeLongerName, CBORParser.decodeChunkedName, and SmileParser.handleLongFieldName, which accumulate a decoded property name without applying the maxNameLength constrai...

ai.timefold.solver:timefold-solver-migration (>=1.24.0, <=2.3.0), ch.admin.bit.jeap.openrewrite.recipe:jeap-rewrite-recipes (>=1.5.1, <=1.5.6) +953 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.19.0, <=2.21.5)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.19.0, =1.24.0, =1.5.1, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =2.0.59, =1.41.5, =1.43.1 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...

ai.timefold.solver:timefold-solver-migration (>=2.4.0-rc-1, <=2.6.0), com.buession.cas:cas-server-support-captcha (5.0.0) +190 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.22.0, =2.4.0-rc-1, =2.22.0, =2.22.0, =0.132.0, =6.4.0, =6.4.0, =6.4.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.40.0, =8.42.0 - com.palantir.conjure.java:conjure-java-undertow-runtime...

ai.timefold.solver:timefold-solver-migration (>=1.7.0, <=1.23.0), com.alibaba.fastjson2:fastjson2-extension-spring5 (>=2.0.43, <=2.0.58) +1084 more potentially affected by CVE-2026-68496 via com.fasterxml.jackson.dataformat:jackson-dataformat-smile (>=2.16.0, <=2.18.9)

com.fasterxml.jackson.dataformat:jackson-dataformat-smile MAVEN version =2.16.0, =1.7.0, =2.0.43, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =0.0.3, =0.0.3, =1.41.0, =1.49.1, =1.49.1, =1.50.6 and more Source cves: CVE-2026-68496 Source advisory: MEND:CVE-2026-68496...

com.erudika:para-search-elasticsearch (>=1.43.1, <=1.43.2), com.netflix.atlas_v1:atlas-chart_2.13 (>=1.9.0-rc.12, <=1.9.0-rc.20) +479 more potentially affected by CVE-2026-68496 via tools.jackson.dataformat:jackson-dataformat-smile (>=3.2.0, <=3.2.1)

tools.jackson.dataformat:jackson-dataformat-smile MAVEN version =3.2.0, =1.43.1, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.12, =1.9.0-rc.20 and mor...