CVE-2026-68495
Received Received - Intake

Memory Exhaustion in FasterXML Jackson CBOR Parser

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: HeroDevs

Description
The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLongerName() decodes a definite-length property name with no length check, and CBORParser._decodeChunkedName() delegates to the value-oriented _finishChunkedText() routine, which validates maxStringLength rather than maxNameLength. An attacker who can have a CBOR document parsed may therefore embed a single property name of unbounded length; the parser buffers the whole name in memory before returning it, whatever maxNameLength is configured to. Because StreamReadConstraints.maxDocumentLength is also disabled by default, nothing else bounds the name under default settings, so the only limits are the attacker's upload capacity and available heap, leading to memory exhaustion and denial of service. No privileges beyond the ability to submit data to a parsing endpoint are required, and exploitation needs only that the bytes reach CBORFactory parsing, directly or through an ObjectMapper configured with the CBOR module. jackson-core's own JSON parsers enforce maxNameLength incrementally during name decoding; this gap is specific to the binary formats. maxNameLength and validateNameLength were introduced in jackson-core 2.16.0, so releases before 2.16.0 do not contain the constraint that is left unenforced. This issue is tracked together with the Smile parser defect in the same vendor advisory, GHSA-3v8f-v6vx-fmrm, which covers both binary formats. The CBOR parser defect (jackson-dataformats-binary issue #725) is CVE-2026-68495; the Smile parser defect (issue #726) is assigned CVE-2026-68496.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-68495
EUVD
EUVD-2026-90977

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
fasterxml jackson-dataformats-binary to 2.16.0 (exc)
fasterxml jackson-core to 2.16.0 (exc)
fasterxml jackson-dataformat-cbor to 2.18.10 (exc)
fasterxml jackson-dataformat-smile to 2.18.10 (exc)
fasterxml jackson-dataformats-binary to 2.18.10 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the CBOR parser of the Jackson-dataformats-binary library. The parser fails to enforce the maxNameLength limit when decoding JSON object property names in CBOR data. This allows an attacker to submit a CBOR document with an extremely long property name, causing the parser to consume excessive memory and potentially crash the system, leading to a denial of service.

Detection Guidance

To detect this vulnerability, monitor for excessive memory usage or crashes in applications using jackson-dataformats-binary versions prior to 2.18.10. Check logs for CBOR parsing errors or heap exhaustion events. Use tools like jstack or top to identify processes consuming abnormal memory.

Impact Analysis

If you use the affected Jackson-dataformats-binary library to parse CBOR data, an attacker could exploit this flaw by sending a specially crafted CBOR document with a very long property name. This could exhaust system memory, crash applications, or disrupt services, resulting in a denial of service. No special privileges are needed beyond the ability to submit data to a parsing endpoint.

Compliance Impact

This vulnerability could lead to denial-of-service conditions due to memory exhaustion, which may impact the availability of systems handling CBOR data. While not directly violating GDPR or HIPAA, such disruptions could affect compliance by impairing access to personal or health data during outages, potentially violating availability requirements under these regulations.

Mitigation Strategies

Upgrade to jackson-dataformats-binary version 2.18.10 or later to ensure maxNameLength is enforced during CBOR parsing. Additionally, review and set appropriate StreamReadConstraints limits in your ObjectMapper configuration to prevent unbounded memory usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68495. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart