CVE-2026-104895

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-104895", "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "state": "PUBLISHED", "assignerShortName": "HeroDevs", "dateReserved": "2026-10-02T15:02:48.774Z", "datePublished": "2026-10-28T00:01:44.496Z", "dateUpdated": "2026-11-04T20:20:04.126Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs", "dateUpdated": "2026-10-28T00:01:44.496Z"}, "title": "jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "affected": [{"vendor": "FasterXML", "product": "jackson-dataformat-smile", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-smile", "repo": "https://github.com/FasterXML/jackson-dataformats-binary", "versions": [{"status": "affected", "version": "2.9.0", "lessThan": "2.18.12", "versionType": "maven"}, {"status": "unaffected", "version": "2.18.12", "versionType": "maven"}, {"status": "affected", "version": "2.19.0", "lessThan": "2.21.8", "versionType": "maven"}, {"status": "unaffected", "version": "2.21.8", "versionType": "maven"}, {"status": "affected", "version": "2.22.0", "lessThan": "2.22.4", "versionType": "maven"}, {"status": "unaffected", "version": "2.22.4", "versionType": "maven"}], "defaultStatus": "unaffected"}, {"vendor": "FasterXML", "product": "jackson-dataformat-smile", "collectionURL": "https://repo.maven.apache.org/maven2", "packageName": "tools.jackson.dataformat:jackson-dataformat-smile", "repo": "https://github.com/FasterXML/jackson-dataformats-binary", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.8", "versionType": "maven"}, {"status": "unaffected", "version": "3.1.8", "versionType": "maven"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.4", "versionType": "maven"}, {"status": "unaffected", "version": "3.2.4", "versionType": "maven"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\n\n\n\nA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\n\n\n\nThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value &lt;&lt; 6) + (i &amp; 0x3F) without the (value &gt;&gt;&gt; 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.</p><p>A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.</p><p>This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.</p>"}]}], "tags": ["x_open-source"], "references": [{"url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w", "name": "GHSA-h3c2-2m49-r49w", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "timeline": [{"time": "2026-10-20T22:47:00.000Z", "lang": "en", "value": "GHSA-h3c2-2m49-r49w published by the maintainer in FasterXML/jackson-dataformats-binary"}], "credits": [{"lang": "en", "value": "apvxlab (AppViewX security research)", "type": "reporter"}, {"lang": "en", "value": "Michael-JRead", "type": "reporter"}, {"lang": "en", "value": "cowtowncoder (Tatu Saloranta)", "type": "coordinator"}], "source": {"advisory": "GHSA-h3c2-2m49-r49w", "discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T20:07:57.102322Z", "id": "CVE-2026-104895", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:20:04.126Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-104895", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T20:07:57.102322Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T20:07:57.787Z"}}], "cna": {"tags": ["x_open-source"], "title": "jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service", "source": {"advisory": "GHSA-h3c2-2m49-r49w", "discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "apvxlab (AppViewX security research)"}, {"lang": "en", "type": "reporter", "value": "Michael-JRead"}, {"lang": "en", "type": "coordinator", "value": "cowtowncoder (Tatu Saloranta)"}], "impacts": [{"capecId": "CAPEC-130", "descriptions": [{"lang": "en", "value": "CAPEC-130 Excessive Allocation"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/FasterXML/jackson-dataformats-binary", "vendor": "FasterXML", "product": "jackson-dataformat-smile", "versions": [{"status": "affected", "version": "2.9.0", "lessThan": "2.18.12", "versionType": "maven"}, {"status": "unaffected", "version": "2.18.12", "versionType": "maven"}, {"status": "affected", "version": "2.19.0", "lessThan": "2.21.8", "versionType": "maven"}, {"status": "unaffected", "version": "2.21.8", "versionType": "maven"}, {"status": "affected", "version": "2.22.0", "lessThan": "2.22.4", "versionType": "maven"}, {"status": "unaffected", "version": "2.22.4", "versionType": "maven"}], "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-smile", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}, {"repo": "https://github.com/FasterXML/jackson-dataformats-binary", "vendor": "FasterXML", "product": "jackson-dataformat-smile", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.8", "versionType": "maven"}, {"status": "unaffected", "version": "3.1.8", "versionType": "maven"}, {"status": "affected", "version": "3.2.0", "lessThan": "3.2.4", "versionType": "maven"}, {"status": "unaffected", "version": "3.2.4", "versionType": "maven"}], "packageName": "tools.jackson.dataformat:jackson-dataformat-smile", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-10-20T22:47:00.000Z", "value": "GHSA-h3c2-2m49-r49w published by the maintainer in FasterXML/jackson-dataformats-binary"}], "references": [{"url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w", "name": "GHSA-h3c2-2m49-r49w", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\n\n\n\nA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\n\n\n\nThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.", "supportingMedia": [{"type": "text/html", "value": "<p>The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value &lt;&lt; 6) + (i &amp; 0x3F) without the (value &gt;&gt;&gt; 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.</p><p>A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.</p><p>This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789 Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "shortName": "HeroDevs", "dateUpdated": "2026-10-28T00:01:44.496Z"}}}, "cveMetadata": {"cveId": "CVE-2026-104895", "state": "PUBLISHED", "dateUpdated": "2026-11-04T20:20:04.126Z", "dateReserved": "2026-10-02T15:02:48.774Z", "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c", "datePublished": "2026-10-28T00:01:44.496Z", "assignerShortName": "HeroDevs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-smile", "product": "jackson-dataformat-smile", "repo": "https://github.com/FasterXML/jackson-dataformats-binary", "vendor": "FasterXML", "versions": [{"lessThan": "2.18.12", "status": "affected", "version": "2.9.0", "versionType": "maven"}, {"status": "unaffected", "version": "2.18.12", "versionType": "maven"}, {"lessThan": "2.21.8", "status": "affected", "version": "2.19.0", "versionType": "maven"}, {"status": "unaffected", "version": "2.21.8", "versionType": "maven"}, {"lessThan": "2.22.4", "status": "affected", "version": "2.22.0", "versionType": "maven"}, {"status": "unaffected", "version": "2.22.4", "versionType": "maven"}]}, {"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "tools.jackson.dataformat:jackson-dataformat-smile", "product": "jackson-dataformat-smile", "repo": "https://github.com/FasterXML/jackson-dataformats-binary", "vendor": "FasterXML", "versions": [{"lessThan": "3.1.8", "status": "affected", "version": "3.0.0", "versionType": "maven"}, {"status": "unaffected", "version": "3.1.8", "versionType": "maven"}, {"lessThan": "3.2.4", "status": "affected", "version": "3.2.0", "versionType": "maven"}, {"status": "unaffected", "version": "3.2.4", "versionType": "maven"}]}], "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\n\n\n\nA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\n\n\n\nThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required."}], "id": "CVE-2026-104895", "lastModified": "2026-11-04T21:17:42.683", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-104895", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T20:07:57.102322Z", "version": "2.0.3"}}]}, "published": "2026-10-28T00:17:11.357", "references": [{"source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w"}], "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "36c7be3b-2937-45df-85ea-ca7133ea542c", "type": "Secondary"}]}

{"bugzilla": {"description": "com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser", "id": "2562517", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562517"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in jackson-dataformat-smile. A remote attacker can cause a Denial of Service (DoS) by submitting specially crafted binary data to an asynchronous parsing endpoint. The parser fails to validate length prefixes, allowing untrusted input to trigger integer overflows or excessive memory allocations without upper bounds. Successful exploitation results in an application or processing thread crash."], "name": "CVE-2026-104895", "package_state": [{"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Affected", "package_name": "jackson-dataformat-smile", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "pki-deps:10.6/jackson-jaxrs-providers", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "jackson-jaxrs-providers", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Fix deferred", "package_name": "jackson-dataformat-smile", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Not affected", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Affected", "package_name": "openvox-server", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-28T00:01:44Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-104895\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104895\nhttps://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w"], "statement": "This vulnerability is rated as Important because unauthenticated remote attackers can trigger an application crash or service denial using minimal network traffic, though data confidentiality and integrity are not compromised. Exploitation is constrained to endpoints explicitly configured to process untrusted binary input via reactive or asynchronous Smile parsers. Typical deployments using standard blocking parsers or conventional JSON serialization are not vulnerable to this issue.", "threat_severity": "Important"}

{"created": "2026-10-28T01:30:14.279615+00:00", "updated": "2026-11-05T02:00:16.255032+00:00", "vendors": []}