CVE-2026-106554
Received Received - Intake

Denial of Service in Jackson CBOR Parser via Unbounded Tag Chain

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: HeroDevs

Description
One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList). CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags. PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit. Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool. Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-106554
EUVD
EUVD-2026-116970

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-407 An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an algorithmic-complexity denial of service in jackson-dataformats-binary's CBOR module. It occurs when an attacker sends a CBOR stream with an unbounded chain of tags before a value. The parser accumulates these tags in a TagList that grows by a fixed increment, causing O(N^2) time complexity. This leads to CPU and garbage collection exhaustion, pinning request threads.

Detection Guidance

Monitor for unusually high CPU or memory usage during CBOR parsing tasks. Check application logs for slow response times or timeouts when processing CBOR data. Use network traffic analysis tools to detect excessive CBOR tag sequences.

Impact Analysis

An attacker could exploit this to cause a denial of service by consuming excessive CPU and memory resources. This could slow down or crash systems processing CBOR data, leading to degraded performance or unavailability of services relying on the jackson-dataformat-cbor library.

Mitigation Strategies

Upgrade jackson-dataformat-cbor to a patched version (2.22.4+ or 3.2.4+). Implement input validation to limit CBOR tag counts. Apply StreamReadConstraints-style limits to cap stacked tags. Monitor affected systems for abnormal resource consumption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...