Read the docs
TI-2026-81634 Aliases CVE-2026-104895

Unbounded allocation in jackson-dataformat-smile async parser

Priority LOW 39CWE-789Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 5 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-789.

Summary

jackson-dataformat-smile is affected from 2.9.0 before 2.18.12, from 2.19.0 before 2.21.8, from 2.22.0 before 2.22.4, from 3.0.0 before 3.1.8 and from 3.2.0 before 3.2.4. The asynchronous Smile parser allocates a byte array sized by an untrusted length prefix before reading the body, with no upper bound (CWE-789). An attacker who can submit data for parsing needs no privileges, and a feed of about ten bytes can force a roughly 2 GB allocation that crashes the thread.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0038 32nd percentileScored 2026-11-07
Fix Partial jackson-dataformat-smile (FasterXML): 2.18.12, 2.21.8, 2.22.4 +2Red Hat: 4 advisoriesRed Hat: 5 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-dataformat-smile2.9.0 to before 2.18.12; 2.19.0 to before 2.21.8; 2.22.0 to before 2.22.42.18.12, 2.21.8, 2.22.4Patch availableCNA
FasterXMLjackson-dataformat-smile3.0.0 to before 3.1.8; 3.2.0 to before 3.2.43.1.8, 3.2.4Patch availableCNA
  • jackson-dataformat-smile VendorFasterXML Affected 2.9.0 to before 2.18.12; 2.19.0 to before 2.21.8; 2.22.0 to before 2.22.4 Fixed in 2.18.12, 2.21.8, 2.22.4 Patch available CNA
  • jackson-dataformat-smile VendorFasterXML Affected 3.0.0 to before 3.1.8; 3.2.0 to before 3.2.4 Fixed in 3.1.8, 3.2.4 Patch available CNA

Remediation

Upgrade to jackson-dataformat-smile 2.18.12, 2.21.8, 2.22.4, 3.1.8 or 3.2.4. Red Hat fixes Satellite 6.16 for RHEL 8 and RHEL 9 in RHSA-2026:95655, Satellite 6.17 for RHEL 9 in RHSA-2026:95656, Satellite 6.18 for RHEL 9 in RHSA-2026:95657 and Satellite 6.19 for RHEL 9 in RHSA-2026:95652. The sources list no fixed version for Red Hat Fuse 7 or Red Hat build of Apache Camel for Spring Boot 4.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA jackson-dataformat-smile (FasterXML) Fixed in 2.18.12, 2.21.8, 2.22.4
  • Fix · CNA jackson-dataformat-smile (FasterXML) Fixed in 3.1.8, 3.2.4

Red Hat 4 advisories

  • RHSA-2026:95655 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.16 EUS security update
    • Red Hat Satellite 6.16 for RHEL 8 openvox-agent-8.32.0-1.el8sat, openvox-server-8.18.0-1.el8sat, python-brotli-1.2.1-1.el8pc +11
    • Red Hat Satellite 6.16 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +11
  • RHSA-2026:95657 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.18 security update
    • Red Hat Satellite 6.18 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python3.12-brotli-1.2.1-1.el9pc +4
  • RHSA-2026:95656 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.17 security update
    • Red Hat Satellite 6.17 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat, python-brotli-1.2.1-1.el9pc +9
Show 1 more Red Hat advisories
  • RHSA-2026:95652 Released 2026-11-05 · Red Hat rating Critical
    Satellite 6.19 security update
    • Red Hat Satellite 6.19 for RHEL 9 openvox-agent-8.32.0-1.el9sat, openvox-server-8.18.0-1.el9sat

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:95655
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:95655
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:95656
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:95657
Red Hat Satellite 6.19 for RHEL 9Fixed RHSA-2026:95652
Not affected: 8 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Offline Knowledge Portal
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Satellite 6.19 for RHEL 9

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-104895
  2. 2026-10-28 Priority changed: MEDIUM → LOW
  3. 2026-11-04 Affected versions changed · Red Hat
  4. 2026-11-04 CVSS score added · Red Hat
  5. 2026-11-04 CISA SSVC decision points changed
  6. 2026-11-05 Affected versions changed · Red Hat
  7. 2026-11-06 Fix available: Red Hat Satellite 6.16 for RHEL 8, Red Hat Satellite 6.16 for RHEL 9, Red Hat Satellite 6.17 for RHEL 9 +2 · Red Hat
  8. 2026-11-06 Fix available: RHSA-2026:95652 · Red Hat
  9. 2026-11-06 Fix available: RHSA-2026:95656 · Red Hat
  10. 2026-11-06 Fix available: RHSA-2026:95655 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:95657 · Red Hat

References

Advisory 1

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences