com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf vulnerabilities
CVEs whose affected-version data names the com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-110747High· 7.5jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the ad…
▾ TwilightFasterXML · com.fasterxml.jackson.dataformat:jackson-dataformat-protobufvia CVEORG
CVE-2026-104016High· 7.5jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supp…
▾ TwilightFasterXML · com.fasterxml.jackson.dataformat:jackson-dataformat-protobufvia CVEORG