Read the docs
TI-2026-81633 Aliases CVE-2026-104016

Integer overflow in jackson-dataformat-protobuf string parsing

Priority MEDIUM 40CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

FasterXML jackson-dataformat-protobuf from 2.6.0 before 2.18.12, from 2.19.0 before 2.21.8, from 2.22.0 before 2.22.4, from 3.0.0 before 3.1.8 and from 3.2.0 before 3.2.4 is affected. The protobuf parser checks string and bytes lengths with 32-bit signed arithmetic, so a crafted length near Integer.MAX_VALUE overflows and passes the bounds check (CWE-190). A remote attacker who can submit data for parsing can trigger an unbounded array allocation that throws OutOfMemoryError, causing a denial of service.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit. The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured. A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00679 52nd percentileScored 2026-11-07
Fix Partial jackson-dataformat-protobuf (FasterXML): 2.18.12, 2.21.8, 2.22.4 +2Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-dataformat-protobuf2.6.0 to before 2.18.12; 2.19.0 to before 2.21.8; 2.22.0 to before 2.22.42.18.12, 2.21.8, 2.22.4Patch availableCNA
FasterXMLjackson-dataformat-protobuf3.0.0 to before 3.1.8; 3.2.0 to before 3.2.43.1.8, 3.2.4Patch availableCNA
  • jackson-dataformat-protobuf VendorFasterXML Affected 2.6.0 to before 2.18.12; 2.19.0 to before 2.21.8; 2.22.0 to before 2.22.4 Fixed in 2.18.12, 2.21.8, 2.22.4 Patch available CNA
  • jackson-dataformat-protobuf VendorFasterXML Affected 3.0.0 to before 3.1.8; 3.2.0 to before 3.2.4 Fixed in 3.1.8, 3.2.4 Patch available CNA

Remediation

Upgrade jackson-dataformat-protobuf to 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4, depending on the release line in use. Red Hat fixes Red Hat Build of Apache Camel 3.33.4.SP1 in RHSA-2026:91304. Red Hat lists no available fix for Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3 or Red Hat build of Apache Camel for Spring Boot 4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA jackson-dataformat-protobuf (FasterXML) Fixed in 2.18.12, 2.21.8, 2.22.4
  • Fix · CNA jackson-dataformat-protobuf (FasterXML) Fixed in 3.1.8, 3.2.4

Red Hat 1 advisory

  • RHSA-2026:91304 Released 2026-10-27 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP1)
    • Red Hat Build of Apache Camel 3.33.4.SP1 com.fasterxml.jackson.core.jackson-databind-2.21.8.redhat-00001.jar, com.fasterxml.jackson.dataformat.jackson-dataformat-protobuf-2.21.8.redhat-00001.jar

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.4.SP1Fixed RHSA-2026:91304
Not affected: 1 product
  • Red Hat Build of Apache Camel 3.33.4.SP1

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-104016
  2. 2026-10-28 Priority changed: MEDIUM → LOW
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-10-30 Fix available: Red Hat Build of Apache Camel 3.33.4.SP1 · Red Hat
  6. 2026-10-31 Fix available: RHSA-2026:91304 · Red Hat
  7. 2026-11-04 CISA SSVC decision points changed
  8. 2026-11-04 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences