---
id: CVE-2026-104895
title: >-
  jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in
  the async parser allows OutOfMemoryError denial of service
summary: >-
  The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary
  length prefix taken from untrusted input to allocate a byte[] before the body
  is read, with no upper bound and no overflow check. On the raw-binary marker
  0xFD,…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-789
vendor: FasterXML
product: 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile'
affected:
  - 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.9.0 < 2.18.12'
  - 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.19.0 < 2.21.8'
  - 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.22.0 < 2.22.4'
  - 'tools.jackson.dataformat:jackson-dataformat-smile >= 3.0.0 < 3.1.8'
  - 'tools.jackson.dataformat:jackson-dataformat-smile >= 3.2.0 < 3.2.4'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T00:01:44.496Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-104895'
references:
  - url: >-
      https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w
    label: GHSA-h3c2-2m49-r49w
tags:
  - cve.org
ingestedAt: '2026-10-28T01:01:24.229Z'
---

## Overview

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.



A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.



This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

## Affected

- `com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.9.0 < 2.18.12`
- `com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.19.0 < 2.21.8`
- `com.fasterxml.jackson.dataformat:jackson-dataformat-smile >= 2.22.0 < 2.22.4`
- `tools.jackson.dataformat:jackson-dataformat-smile >= 3.0.0 < 3.1.8`
- `tools.jackson.dataformat:jackson-dataformat-smile >= 3.2.0 < 3.2.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.