Search
Find a vulnerability
Search criteria
2 vulnerabilities found for jackson-dataformat-smile by FasterXML
CVE-2026-104895 (GCVE-0-2026-104895)
Vulnerability from nvd – Published: 2026-10-28 00:01 – Updated: 2026-10-28 00:01 X_Open Source
VLAI
EPSS
VEX
Title
jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
Summary
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.
A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.
This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
Severity
7.5 (High)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/FasterXML/jackson-dataformats-… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FasterXML | jackson-dataformat-smile |
Affected:
2.9.0 , < 2.18.12
(maven)
Unaffected: 2.18.12 (maven) Affected: 2.19.0 , < 2.21.8 (maven) Unaffected: 2.21.8 (maven) Affected: 2.22.0 , < 2.22.4 (maven) Unaffected: 2.22.4 (maven) |
|
| FasterXML | jackson-dataformat-smile |
Affected:
3.0.0 , < 3.1.8
(maven)
Unaffected: 3.1.8 (maven) Affected: 3.2.0 , < 3.2.4 (maven) Unaffected: 3.2.4 (maven) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-smile",
"product": "jackson-dataformat-smile",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "2.18.12",
"status": "affected",
"version": "2.9.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.18.12",
"versionType": "maven"
},
{
"lessThan": "2.21.8",
"status": "affected",
"version": "2.19.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.21.8",
"versionType": "maven"
},
{
"lessThan": "2.22.4",
"status": "affected",
"version": "2.22.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.22.4",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "tools.jackson.dataformat:jackson-dataformat-smile",
"product": "jackson-dataformat-smile",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "3.1.8",
"status": "affected",
"version": "3.0.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.1.8",
"versionType": "maven"
},
{
"lessThan": "3.2.4",
"status": "affected",
"version": "3.2.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.2.4",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "apvxlab (AppViewX security research)"
},
{
"lang": "en",
"type": "reporter",
"value": "Michael-JRead"
},
{
"lang": "en",
"type": "coordinator",
"value": "cowtowncoder (Tatu Saloranta)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value \u0026lt;\u0026lt; 6) + (i \u0026amp; 0x3F) without the (value \u0026gt;\u0026gt;\u0026gt; 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\u003c/p\u003e\u003cp\u003eA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\u003c/p\u003e\u003cp\u003eThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.\u003c/p\u003e"
}
],
"value": "The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value \u003c\u003c 6) + (i \u0026 0x3F) without the (value \u003e\u003e\u003e 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\n\n\n\nA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\n\n\n\nThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T00:01:44.496Z",
"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"shortName": "HeroDevs"
},
"references": [
{
"name": "GHSA-h3c2-2m49-r49w",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w"
}
],
"source": {
"advisory": "GHSA-h3c2-2m49-r49w",
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T22:47:00.000Z",
"value": "GHSA-h3c2-2m49-r49w published by the maintainer in FasterXML/jackson-dataformats-binary"
}
],
"title": "jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"assignerShortName": "HeroDevs",
"cveId": "CVE-2026-104895",
"datePublished": "2026-10-28T00:01:44.496Z",
"dateReserved": "2026-10-02T15:02:48.774Z",
"dateUpdated": "2026-10-28T00:01:44.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104895 (GCVE-0-2026-104895)
Vulnerability from cvelistv5 – Published: 2026-10-28 00:01 – Updated: 2026-10-28 00:01 X_Open Source
VLAI
EPSS
VEX
Title
jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
Summary
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.
A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.
This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
Severity
7.5 (High)
CWE
- CWE-789 - Memory Allocation with Excessive Size Value
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/FasterXML/jackson-dataformats-… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| FasterXML | jackson-dataformat-smile |
Affected:
2.9.0 , < 2.18.12
(maven)
Unaffected: 2.18.12 (maven) Affected: 2.19.0 , < 2.21.8 (maven) Unaffected: 2.21.8 (maven) Affected: 2.22.0 , < 2.22.4 (maven) Unaffected: 2.22.4 (maven) |
|
| FasterXML | jackson-dataformat-smile |
Affected:
3.0.0 , < 3.1.8
(maven)
Unaffected: 3.1.8 (maven) Affected: 3.2.0 , < 3.2.4 (maven) Unaffected: 3.2.4 (maven) |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-smile",
"product": "jackson-dataformat-smile",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "2.18.12",
"status": "affected",
"version": "2.9.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.18.12",
"versionType": "maven"
},
{
"lessThan": "2.21.8",
"status": "affected",
"version": "2.19.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.21.8",
"versionType": "maven"
},
{
"lessThan": "2.22.4",
"status": "affected",
"version": "2.22.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.22.4",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "tools.jackson.dataformat:jackson-dataformat-smile",
"product": "jackson-dataformat-smile",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "3.1.8",
"status": "affected",
"version": "3.0.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.1.8",
"versionType": "maven"
},
{
"lessThan": "3.2.4",
"status": "affected",
"version": "3.2.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.2.4",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "apvxlab (AppViewX security research)"
},
{
"lang": "en",
"type": "reporter",
"value": "Michael-JRead"
},
{
"lang": "en",
"type": "coordinator",
"value": "cowtowncoder (Tatu Saloranta)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value \u0026lt;\u0026lt; 6) + (i \u0026amp; 0x3F) without the (value \u0026gt;\u0026gt;\u0026gt; 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\u003c/p\u003e\u003cp\u003eA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\u003c/p\u003e\u003cp\u003eThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.\u003c/p\u003e"
}
],
"value": "The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value \u003c\u003c 6) + (i \u0026 0x3F) without the (value \u003e\u003e\u003e 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\n\n\n\nA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\n\n\n\nThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-789",
"description": "CWE-789 Memory Allocation with Excessive Size Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T00:01:44.496Z",
"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"shortName": "HeroDevs"
},
"references": [
{
"name": "GHSA-h3c2-2m49-r49w",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w"
}
],
"source": {
"advisory": "GHSA-h3c2-2m49-r49w",
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T22:47:00.000Z",
"value": "GHSA-h3c2-2m49-r49w published by the maintainer in FasterXML/jackson-dataformats-binary"
}
],
"title": "jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"assignerShortName": "HeroDevs",
"cveId": "CVE-2026-104895",
"datePublished": "2026-10-28T00:01:44.496Z",
"dateReserved": "2026-10-02T15:02:48.774Z",
"dateUpdated": "2026-10-28T00:01:44.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}