CVE-2026-106554

Two CBOR-parsing issues in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time "TagList" growth CPU/GC-exhaustion DoS, PoC-proven, and the configured "StreamReadConstraints.maxStringLength" limit is not enforced for CBOR text-string values a...