FasterXML jackson-dataformat-protobuf: Signed integer overflow denial-of-service (CVE-2026-104016)

A signed integer overflow vulnerability in jackson-dataformat-protobuf (CVE-2026-104016) allows attackers to crash services via an OutOfMemoryError. The vulnerability exists because ProtobufParser utilizes 32-bit signed integer arithmetic for bounds checking when parsing length-prefixed strings. By providing a varint-encoded length near Integer.MAX_VALUE, an attacker can cause an overflow during pointer calculation, bypassing bounds checks and triggering an unrestrained memory allocation in TextBuffer.expandCurrentSegment.

This vulnerability is significant because existing configuration-based protections, such as StreamReadConstraints (e.g., maxStringLength, maxDocumentLength), fail to gate this specific code path. Furthermore, the JVM rejects the resulting massive array allocation before application-level heap constraints are evaluated, making -Xmx heap tuning ineffective as a mitigation.

Impact

Successful exploitation results in an immediate service disruption via OutOfMemoryError, effectively achieving a denial-of-service (DoS) against any Java service processing untrusted Protobuf data using affected versions of the library.

Recommendation

• Identify all Java applications utilizing jackson-dataformat-protobuf in the dependency tree.
• Prioritize updating to the patched version of jackson-dataformat-protobuf as identified in the upstream GitHub advisory (GHSA-c2rq-mcfv-jw29).
• Implement request size limits at the network edge or WAF layer to prevent processing of excessively large, malformed Protobuf messages if patching is delayed.
• Monitor application logs for frequent OutOfMemoryError events associated with deserialization processes.