---
id: CVE-2026-104016
title: >-
  jackson-dataformat-protobuf: signed integer overflow in string-length paths
  allows unbounded array allocation and OutOfMemoryError
summary: >-
  ProtobufParser parses length-prefixed protobuf string and bytes fields by
  checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling
  _finishShortText(len). Both use 32-bit signed integer arithmetic. When an
  attacker supp…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-190
vendor: FasterXML
product: 'com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf'
affected:
  - >-
    com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf >= 2.6.0 <
    2.18.12
  - >-
    com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf >= 2.19.0 <
    2.21.8
  - >-
    com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf >= 2.22.0 <
    2.22.4
  - 'tools.jackson.dataformat:jackson-dataformat-protobuf >= 3.0.0 < 3.1.8'
  - 'tools.jackson.dataformat:jackson-dataformat-protobuf >= 3.2.0 < 3.2.4'
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T23:52:20.141Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104016'
references:
  - url: >-
      https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-c2rq-mcfv-jw29
    label: GHSA-c2rq-mcfv-jw29
tags:
  - cve.org
ingestedAt: '2026-10-28T01:01:24.230Z'
---

## Overview

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit.



The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured.



A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.

## Affected

- `com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf >= 2.6.0 < 2.18.12`
- `com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf >= 2.19.0 < 2.21.8`
- `com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf >= 2.22.0 < 2.22.4`
- `tools.jackson.dataformat:jackson-dataformat-protobuf >= 3.0.0 < 3.1.8`
- `tools.jackson.dataformat:jackson-dataformat-protobuf >= 3.2.0 < 3.2.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.