Media
jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)
FasterXML jackson-dataformat-cbor
One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2…