FasterXML jackson-dataformats-binary vulnerabilities (CVE)

CVE records published for FasterXML jackson-dataformats-binary, newest first. Follow to get an email when a new one appears.

2 results

7.5High

CVE-2026-68496 1 month ago

jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

FasterXML jackson-dataformats-binary

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName() grows it…

7.5High

CVE-2026-68495 1 month ago

jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

FasterXML jackson-dataformats-binary

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLongerName() decodes a def…