Vulnerability-Lookup

CVE-2026-106554 (GCVE-0-2026-106554)

Vulnerability from cvelistv5 – Published: 2026-11-04 16:14 – Updated: 2026-11-04 16:14 X_Open Source

Title

jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

Summary

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList). CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags. PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit. Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool. Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).

Severity

No CVSS data available.

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

HeroDevs CNA under the mitre root

CNA scorecard B 82/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/FasterXML/jackson-dataformats-…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
FasterXML	jackson-dataformat-cbor	Affected: 2.15.0 , < 2.18.12 (maven) Unaffected: 2.18.12 (maven) Affected: 2.19.0 , < 2.21.8 (maven) Unaffected: 2.21.8 (maven) Affected: 2.22.0 , < 2.22.4 (maven) Unaffected: 2.22.4 (maven)	guessed
FasterXML	jackson-dataformat-cbor	Affected: 3.0.0 , < 3.1.8 (maven) Unaffected: 3.1.8 (maven) Affected: 3.2.0 , < 3.2.4 (maven) Unaffected: 3.2.4 (maven)	guessed

Credits

apvxlab (AppViewX security research) v0xyc0n (www.jpac.at)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "2.18.12",
              "status": "affected",
              "version": "2.15.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.18.12",
              "versionType": "maven"
            },
            {
              "lessThan": "2.21.8",
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.21.8",
              "versionType": "maven"
            },
            {
              "lessThan": "2.22.4",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.22.4",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "tools.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "3.1.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.1.8",
              "versionType": "maven"
            },
            {
              "lessThan": "3.2.4",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.2.4",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "apvxlab (AppViewX security research)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "v0xyc0n (www.jpac.at)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOne CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\u003c/p\u003e\u003cp\u003ePoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\u003c/p\u003e\u003cp\u003eQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u0026gt; TagList).\u003c/p\u003e\u003cp\u003eCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\u003c/p\u003e\u003cp\u003ePoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\u003c/p\u003e\u003cp\u003eImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\u003c/p\u003e\u003cp\u003eFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).\u003c/p\u003e"
            }
          ],
          "value": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "MEDIUM"
            },
            "type": "severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407 Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T16:14:05.664Z",
        "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "shortName": "HeroDevs"
      },
      "references": [
        {
          "name": "GHSA-cjg7-h3pr-p927",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"
        }
      ],
      "source": {
        "advisory": "GHSA-cjg7-h3pr-p927",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-22T21:30:00.000Z",
          "value": "GHSA-cjg7-h3pr-p927 published in FasterXML/jackson-dataformats-binary"
        }
      ],
      "title": "jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
    "assignerShortName": "HeroDevs",
    "cveId": "CVE-2026-106554",
    "datePublished": "2026-11-04T16:14:05.664Z",
    "dateReserved": "2026-10-06T20:27:12.839Z",
    "dateUpdated": "2026-11-04T16:14:05.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-106554",
      "date": "2026-11-06",
      "epss": "0.00177",
      "percentile": "0.07357"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor",
                "product": "jackson-dataformat-cbor",
                "programFiles": [
                  "cbor/src/main/java/.../cbor/CBORParser.java"
                ],
                "programRoutines": [
                  {
                    "name": "CBORParser (tag handling -\u003e TagList)"
                  }
                ],
                "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
                "vendor": "FasterXML",
                "versions": [
                  {
                    "lessThan": "2.18.12",
                    "status": "affected",
                    "version": "2.15.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "2.18.12",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "2.21.8",
                    "status": "affected",
                    "version": "2.19.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "2.21.8",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "2.22.4",
                    "status": "affected",
                    "version": "2.22.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "2.22.4",
                    "versionType": "maven"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "tools.jackson.dataformat:jackson-dataformat-cbor",
                "product": "jackson-dataformat-cbor",
                "programFiles": [
                  "cbor/src/main/java/.../cbor/CBORParser.java"
                ],
                "programRoutines": [
                  {
                    "name": "CBORParser (tag handling -\u003e TagList)"
                  }
                ],
                "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
                "vendor": "FasterXML",
                "versions": [
                  {
                    "lessThan": "3.1.8",
                    "status": "affected",
                    "version": "3.0.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "3.1.8",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "3.2.4",
                    "status": "affected",
                    "version": "3.2.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "3.2.4",
                    "versionType": "maven"
                  }
                ]
              }
            ],
            "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."
          }
        ],
        "id": "CVE-2026-106554",
        "lastModified": "2026-11-04T16:17:32.640",
        "metrics": {},
        "published": "2026-11-04T16:17:32.640",
        "references": [
          {
            "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
            "url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"
          }
        ],
        "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-407"
              }
            ],
            "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-06T02:27:26+00:00",
      "cve": "CVE-2026-106554",
      "id": "CVE-2026-106554",
      "initial_release_date": "2026-11-04T16:14:05.664000+00:00",
      "product_status:under_investigation": "23",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "com.fasterxml.jackson.dataformat/jackson-dataformat-cbor: jackson-dataformat-cbor: Denial of Service via unbounded CBOR tags",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106554.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-106554

Vulnerability from fkie_nvd - Published: 2026-11-04 16:17 - Updated: 2026-11-04 16:17

Severity

Summary

References

	URL	Tags
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "2.18.12",
              "status": "affected",
              "version": "2.15.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.18.12",
              "versionType": "maven"
            },
            {
              "lessThan": "2.21.8",
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.21.8",
              "versionType": "maven"
            },
            {
              "lessThan": "2.22.4",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.22.4",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "tools.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "3.1.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.1.8",
              "versionType": "maven"
            },
            {
              "lessThan": "3.2.4",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.2.4",
              "versionType": "maven"
            }
          ]
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."
    }
  ],
  "id": "CVE-2026-106554",
  "lastModified": "2026-11-04T16:17:32.640",
  "metrics": {},
  "published": "2026-11-04T16:17:32.640",
  "references": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"
    }
  ],
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "type": "Secondary"
    }
  ]
}

UBUNTU-CVE-2026-106554 (CVE-2026-106554)

Vulnerability from osv_ubuntu – Published: 2026-11-04 00:00 – Updated: 2026-11-04 00:00 – Source website

Details

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-106554	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-106554	REPORT
	github.com/fasterxml/jackson-dataformats-binary	REPORT
	repo.maven.apache.org/maven2	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.4.3-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.4.3-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-3?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-1",
        "2.7.8-2",
        "2.7.8-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-3",
        "2.7.8-4",
        "2.7.8-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5.1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-5.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-5.1"
      ]
    }
  ],
  "aliases": [],
  "details": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList). CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags. PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit. Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool. Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).",
  "id": "UBUNTU-CVE-2026-106554",
  "modified": "2026-11-04T00:00:00Z",
  "published": "2026-11-04T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-106554"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106554"
    },
    {
      "type": "REPORT",
      "url": "github.com/fasterxml/jackson-dataformats-binary"
    },
    {
      "type": "REPORT",
      "url": "repo.maven.apache.org/maven2"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-106554"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-106554 (GCVE-0-2026-106554)

FKIE_CVE-2026-106554

UBUNTU-CVE-2026-106554 (CVE-2026-106554)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour