Cpe:2.3:a:fasterxml:jackson-Dataformat-Protobuf:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afasterxmljackson-dataformat-protobuf/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 01:35:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFasterXML jackson-dataformat-protobuf: Signed integer overflow denial-of-service (CVE-2026-104016)https://feed.craftedsignal.io/briefs/2026-10-jackson-dataformat-protobuf-integer-overflow/Wed, 28 Oct 2026 01:35:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-jackson-dataformat-protobuf-integer-overflow/A signed integer overflow in the ProtobufParser component of jackson-dataformat-protobuf (CVE-2026-104016) allows unauthenticated remote attackers to trigger an OutOfMemoryError and crash Java applications by providing a maliciously crafted length-prefixed field.A signed integer overflow vulnerability in jackson-dataformat-protobuf (CVE-2026-104016) allows attackers to crash services via an OutOfMemoryError. The vulnerability exists because ProtobufParser utilizes 32-bit signed integer arithmetic for bounds checking when parsing length-prefixed strings. By providing a varint-encoded length near Integer.MAX_VALUE, an attacker can cause an overflow during pointer calculation, bypassing bounds checks and triggering an unrestrained memory allocation in TextBuffer.expandCurrentSegment.

This vulnerability is significant because existing configuration-based protections, such as StreamReadConstraints (e.g., maxStringLength, maxDocumentLength), fail to gate this specific code path. Furthermore, the JVM rejects the resulting massive array allocation before application-level heap constraints are evaluated, making -Xmx heap tuning ineffective as a mitigation.

Impact

Successful exploitation results in an immediate service disruption via OutOfMemoryError, effectively achieving a denial-of-service (DoS) against any Java service processing untrusted Protobuf data using affected versions of the library.

Recommendation

  • Identify all Java applications utilizing jackson-dataformat-protobuf in the dependency tree.
  • Prioritize updating to the patched version of jackson-dataformat-protobuf as identified in the upstream GitHub advisory (GHSA-c2rq-mcfv-jw29).
  • Implement request size limits at the network edge or WAF layer to prevent processing of excessively large, malformed Protobuf messages if patching is delayed.
  • Monitor application logs for frequent OutOfMemoryError events associated with deserialization processes.
]]>lowadvisorydenial-of-servicejavadeserialization