Read the docs
TI-2026-81635 Aliases CVE-2026-110747

Integer overflow in jackson-dataformat-protobuf causes OOM error

Priority LOW 39CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

In jackson-dataformat-protobuf, versions from 2.21.6 before 2.21.8, from 2.22.0 before 2.22.4, from 3.1.6 before 3.1.8 and from 3.2.2 before 3.2.4 are affected. An integer overflow in the map key length check of ProtobufParser._readStringKey() lets a huge length pass, causing an OutOfMemoryError (CWE-190). An unauthenticated remote attacker who can submit data for parsing triggers it with a very small malformed message. Applications with ExitOnOutOfMemoryError terminate.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit. An 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM. This is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00387 33rd percentileScored 2026-11-07
Fix Partial jackson-dataformat-protobuf (FasterXML): 2.21.8, 2.22.4, 3.1.8 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FasterXMLjackson-dataformat-protobuf2.21.6 to before 2.21.8; 2.22.0 to before 2.22.42.21.8, 2.22.4Patch availableCNA
FasterXMLjackson-dataformat-protobuf3.1.6 to before 3.1.8; 3.2.2 to before 3.2.43.1.8, 3.2.4Patch availableCNA
  • jackson-dataformat-protobuf VendorFasterXML Affected 2.21.6 to before 2.21.8; 2.22.0 to before 2.22.4 Fixed in 2.21.8, 2.22.4 Patch available CNA
  • jackson-dataformat-protobuf VendorFasterXML Affected 3.1.6 to before 3.1.8; 3.2.2 to before 3.2.4 Fixed in 3.1.8, 3.2.4 Patch available CNA

Remediation

Upgrade to jackson-dataformat-protobuf 2.21.8, 2.22.4, 3.1.8 or 3.2.4, the fixed version for each release line. Red Hat fixes Red Hat Build of Apache Camel 3.33.4.SP1 in RHSA-2026:91304. Red Hat lists no available fix for Red Hat Fuse 7, Red Hat build of Apache Camel 4 for Quarkus 3 and Red Hat build of Apache Camel for Spring Boot 4.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA jackson-dataformat-protobuf (FasterXML) Fixed in 2.21.8, 2.22.4
  • Fix · CNA jackson-dataformat-protobuf (FasterXML) Fixed in 3.1.8, 3.2.4

Red Hat 1 advisory

  • RHSA-2026:91304 Released 2026-10-27 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.18 for Quarkus 3.33 update is now available (RHBQ 3.33.4.SP1)
    • Red Hat Build of Apache Camel 3.33.4.SP1 com.fasterxml.jackson.core.jackson-databind-2.21.8.redhat-00001.jar, com.fasterxml.jackson.dataformat.jackson-dataformat-protobuf-2.21.8.redhat-00001.jar

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat Build of Apache Camel 3.33.4.SP1Fixed RHSA-2026:91304
Not affected: 1 product
  • Red Hat Build of Apache Camel 3.33.4.SP1

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-110747
  2. 2026-10-28 Priority changed: MEDIUM → LOW
  3. 2026-10-30 Affected versions changed · Red Hat
  4. 2026-10-30 CVSS score added · Red Hat
  5. 2026-10-30 Fix available: Red Hat Build of Apache Camel 3.33.4.SP1 · Red Hat
  6. 2026-10-31 Fix available: RHSA-2026:91304 · Red Hat
  7. 2026-11-06 CISA SSVC decision points changed

References

Advisory 1

  • TI-2017-12774 FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2026-48269 Resource allocation without limits in FasterXML jackson-core CVSS 4.0HIGH 8.7
  • TI-2017-05167 Deserialization of untrusted data in FasterXML jackson-databind CVSS 3.1CRITICAL 9.8
  • TI-2026-61988 jackson-databind: quadratic forward-reference completion in Collection and Map deserializers CVSS 3.1HIGH 7.5
  • TI-2026-61987 jackson-databind: unbounded growth of the type id cache in TypeDeserializerBase retains every unknown raw type ID CVSS 3.1HIGH 7.5
  • TI-2026-60476 Uncontrolled resource consumption in FasterXML jackson-core CVSS 3.1HIGH 7.5
See all 107 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences