Read the docs
TI-2026-48271 Aliases CVE-2026-68496GHSA-fvrx-r5jq-295q

Uncontrolled resource consumption in FasterXML jackson-dataformats-binary

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-400.

Summary

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName() grows its internal name buffer through an unconstrained _growArrayTo() call and performs no length validation. An attacker who can have a Smile document parsed may therefore embed a single property name of unbounded length; the parser buffers the whole name in memory before returning it, whatever maxNameLength is configured to. Because StreamReadConstraints.maxDocumentLength is also disabled by default, nothing else bounds the name under default settings, so the only limits are the attacker's upload capacity and available heap, leading to memory exhaustion and denial of service. No privileges beyond the ability to submit data to a parsing endpoint are required, and exploitation needs only that the bytes reach SmileFactory parsing, directly or through an ObjectMapper configured with the Smile module. jackson-core's own JSON parsers enforce maxNameLength incrementally during name decoding; this gap is specific to the binary formats. maxNameLength and validateNameLength were introduced in jackson-core 2.16.0, so releases before 2.16.0 do not contain the constraint that is left unenforced. This issue is tracked together with the CBOR parser defect in the same vendor advisory, GHSA-3v8f-v6vx-fmrm, which covers both binary formats. The Smile parser defect (jackson-dataformats-binary issue #726) is CVE-2026-68496; the CBOR parser defect (issue #725) is assigned CVE-2026-68495.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-dataformats-binary2.16.0 – 2.18.9; 2.19.0 – 2.21.5; 2.22.0 – 2.22.1—No fix listedCNA
FasterXMLjackson-dataformats-binary3.0.0 – 3.1.5; 3.2.0 – 3.2.1—No fix listedCNA
  • jackson-dataformats-binary VendorFasterXML Affected 2.16.0 – 2.18.9; 2.19.0 – 2.21.5; 2.22.0 – 2.22.1 Fixed in — No fix listed CNA
  • jackson-dataformats-binary VendorFasterXML Affected 3.0.0 – 3.1.5; 3.2.0 – 3.2.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    FasterXML jackson-dataformats-binary — GHSA-3v8f-v6vx-fmrm

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-48270 Uncontrolled resource consumption in FasterXML jackson-dataformats-binaryPriority HIGH 72
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Offline Knowledge PortalAffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Not affected: 1 product
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-68496
  2. 2026-10-03 Alias added: GHSA-fvrx-r5jq-295q
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Advisory 1

Other 2

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences