{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/jackson-dataformat-protobuf/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fasterxml:jackson-dataformat-protobuf:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-104016"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["jackson-dataformat-protobuf"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","java","deserialization"],"_cs_type":"advisory","_cs_vendors":["FasterXML"],"content_html":"\u003cp\u003eA signed integer overflow vulnerability in \u003ccode\u003ejackson-dataformat-protobuf\u003c/code\u003e (CVE-2026-104016) allows attackers to crash services via an \u003ccode\u003eOutOfMemoryError\u003c/code\u003e. The vulnerability exists because \u003ccode\u003eProtobufParser\u003c/code\u003e utilizes 32-bit signed integer arithmetic for bounds checking when parsing length-prefixed strings. By providing a varint-encoded length near \u003ccode\u003eInteger.MAX_VALUE\u003c/code\u003e, an attacker can cause an overflow during pointer calculation, bypassing bounds checks and triggering an unrestrained memory allocation in \u003ccode\u003eTextBuffer.expandCurrentSegment\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eThis vulnerability is significant because existing configuration-based protections, such as \u003ccode\u003eStreamReadConstraints\u003c/code\u003e (e.g., \u003ccode\u003emaxStringLength\u003c/code\u003e, \u003ccode\u003emaxDocumentLength\u003c/code\u003e), fail to gate this specific code path. Furthermore, the JVM rejects the resulting massive array allocation before application-level heap constraints are evaluated, making \u003ccode\u003e-Xmx\u003c/code\u003e heap tuning ineffective as a mitigation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in an immediate service disruption via \u003ccode\u003eOutOfMemoryError\u003c/code\u003e, effectively achieving a denial-of-service (DoS) against any Java service processing untrusted Protobuf data using affected versions of the library.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all Java applications utilizing \u003ccode\u003ejackson-dataformat-protobuf\u003c/code\u003e in the dependency tree.\u003c/li\u003e\n\u003cli\u003ePrioritize updating to the patched version of \u003ccode\u003ejackson-dataformat-protobuf\u003c/code\u003e as identified in the upstream GitHub advisory (GHSA-c2rq-mcfv-jw29).\u003c/li\u003e\n\u003cli\u003eImplement request size limits at the network edge or WAF layer to prevent processing of excessively large, malformed Protobuf messages if patching is delayed.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for frequent \u003ccode\u003eOutOfMemoryError\u003c/code\u003e events associated with deserialization processes.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-28T01:35:47Z","date_published":"2026-10-28T01:35:47Z","id":"https://feed.craftedsignal.io/briefs/2026-10-jackson-dataformat-protobuf-integer-overflow/","summary":"A signed integer overflow in the ProtobufParser component of jackson-dataformat-protobuf (CVE-2026-104016) allows unauthenticated remote attackers to trigger an OutOfMemoryError and crash Java applications by providing a maliciously crafted length-prefixed field.","title":"FasterXML jackson-dataformat-protobuf: Signed integer overflow denial-of-service (CVE-2026-104016)","url":"https://feed.craftedsignal.io/briefs/2026-10-jackson-dataformat-protobuf-integer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Jackson-Dataformat-Protobuf","version":"https://jsonfeed.org/version/1.1"}