CVE-2026-104895 Security Details

CVE ID

CVE-2026-104895

CWE

CWE-789

CVE Description

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

Published

Oct 22, 2026

CVSS Score & Severity

8.7High

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.380%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

com/fasterxml/jackson/dataformat/smile/async/NonBlockingByteArrayParser._decodeVInt()I

JVM

com/fasterxml/jackson/dataformat/smile/async/NonBlockingByteArrayParser._finishRawBinaryLen(II)Lcom/fasterxml/jackson/core/JsonToken;

JVMVulnerable params: 0

com/fasterxml/jackson/dataformat/smile/async/NonBlockingByteArrayParser._startRawBinary()Lcom/fasterxml/jackson/core/JsonToken;

JVM

tools/jackson/dataformat/smile/async/NonBlockingByteArrayParser._decodeVInt()I

JVM

tools/jackson/dataformat/smile/async/NonBlockingByteArrayParser._finishRawBinaryLen(II)Ltools/jackson/core/JsonToken;

JVMVulnerable params: 0

tools/jackson/dataformat/smile/async/NonBlockingByteArrayParser._startRawBinary()Ltools/jackson/core/JsonToken;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

GitHub · FasterXML/jackson-dataformats-binaryPROJECT