CVE-2026-110747 (GCVE-0-2026-110747)
Vulnerability from cvelistv5 – Published: 2026-10-28 00:02 – Updated: 2026-10-28 00:02 X_Open Source
VLAI
EPSS
VEX
Title
jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
Summary
ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.
An 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.
This is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.
Severity
7.5 (High)
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/FasterXML/jackson-dataformats-… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| FasterXML | jackson-dataformat-protobuf |
Affected:
2.21.6 , < 2.21.8
(maven)
Unaffected: 2.21.8 (maven) Affected: 2.22.0 , < 2.22.4 (maven) Unaffected: 2.22.4 (maven) |
guessed | |
| FasterXML | jackson-dataformat-protobuf |
Affected:
3.1.6 , < 3.1.8
(maven)
Unaffected: 3.1.8 (maven) Affected: 3.2.2 , < 3.2.4 (maven) Unaffected: 3.2.4 (maven) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf",
"product": "jackson-dataformat-protobuf",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "2.21.8",
"status": "affected",
"version": "2.21.6",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.21.8",
"versionType": "maven"
},
{
"lessThan": "2.22.4",
"status": "affected",
"version": "2.22.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.22.4",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "tools.jackson.dataformat:jackson-dataformat-protobuf",
"product": "jackson-dataformat-protobuf",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "3.1.8",
"status": "affected",
"version": "3.1.6",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.1.8",
"versionType": "maven"
},
{
"lessThan": "3.2.4",
"status": "affected",
"version": "3.2.2",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.2.4",
"versionType": "maven"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "bewithyash"
},
{
"lang": "en",
"type": "coordinator",
"value": "cowtowncoder (Tatu Saloranta)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eProtobufParser._readStringKey() reads the length prefix of a protobuf map entry\u0027s string key into an attacker-controlled int and then checks (_inputPtr + len) \u0026lt;= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.\u003c/p\u003e\u003cp\u003eAn 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.\u003c/p\u003e\u003cp\u003eThis is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.\u003c/p\u003e"
}
],
"value": "ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry\u0027s string key into an attacker-controlled int and then checks (_inputPtr + len) \u003c= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.\n\n\n\nAn 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.\n\n\n\nThis is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-28T00:02:32.462Z",
"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"shortName": "HeroDevs"
},
"references": [
{
"name": "GHSA-fv7v-rrmh-4qcv",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-fv7v-rrmh-4qcv"
}
],
"source": {
"advisory": "GHSA-fv7v-rrmh-4qcv",
"discovery": "EXTERNAL"
},
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T22:45:00.000Z",
"value": "GHSA-fv7v-rrmh-4qcv published by the maintainer in FasterXML/jackson-dataformats-binary"
}
],
"title": "jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload",
"x_generator": {
"engine": "Vulnogram 0.5.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"assignerShortName": "HeroDevs",
"cveId": "CVE-2026-110747",
"datePublished": "2026-10-28T00:02:32.462Z",
"dateReserved": "2026-10-14T16:51:08.427Z",
"dateUpdated": "2026-10-28T00:02:32.462Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-110747",
"date": "2026-10-28",
"epss": "0.00387",
"percentile": "0.32735"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf",
"product": "jackson-dataformat-protobuf",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "2.21.8",
"status": "affected",
"version": "2.21.6",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.21.8",
"versionType": "maven"
},
{
"lessThan": "2.22.4",
"status": "affected",
"version": "2.22.0",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "2.22.4",
"versionType": "maven"
}
]
},
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "tools.jackson.dataformat:jackson-dataformat-protobuf",
"product": "jackson-dataformat-protobuf",
"repo": "https://github.com/FasterXML/jackson-dataformats-binary",
"vendor": "FasterXML",
"versions": [
{
"lessThan": "3.1.8",
"status": "affected",
"version": "3.1.6",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.1.8",
"versionType": "maven"
},
{
"lessThan": "3.2.4",
"status": "affected",
"version": "3.2.2",
"versionType": "maven"
},
{
"status": "unaffected",
"version": "3.2.4",
"versionType": "maven"
}
]
}
],
"source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry\u0027s string key into an attacker-controlled int and then checks (_inputPtr + len) \u003c= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.\n\n\n\nAn 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.\n\n\n\nThis is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side."
}
],
"id": "CVE-2026-110747",
"lastModified": "2026-10-28T15:24:56.033",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"type": "Secondary"
}
]
},
"published": "2026-10-28T01:16:55.017",
"references": [
{
"source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-fv7v-rrmh-4qcv"
}
],
"sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
"type": "Secondary"
}
]
}
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.