{"id":"CVE-2026-104895","title":"jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service","summary":"The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD,…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-789"],"vendor":"FasterXML","product":"com.fasterxml.jackson.dataformat:jackson-dataformat-smile","affected":["com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.9.0 < 2.18.12","com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.19.0 < 2.21.8","com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.22.0 < 2.22.4","tools.jackson.dataformat:jackson-dataformat-smile >= 3.0.0 < 3.1.8","tools.jackson.dataformat:jackson-dataformat-smile >= 3.2.0 < 3.2.4"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T00:01:44.496Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-104895","references":[{"url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w","label":"GHSA-h3c2-2m49-r49w"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T01:01:24.229Z","slug":"CVE-2026-104895","body":"## Overview\n\nThe asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\n\n\n\nA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\n\n\n\nThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.\n\n## Affected\n\n- `com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.9.0 < 2.18.12`\n- `com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.19.0 < 2.21.8`\n- `com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.22.0 < 2.22.4`\n- `tools.jackson.dataformat:jackson-dataformat-smile >= 3.0.0 < 3.1.8`\n- `tools.jackson.dataformat:jackson-dataformat-smile >= 3.2.0 < 3.2.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}