Vulnerability in ProtobufParser for Jackson Data Formats by FasterXML

CVE-2026-104016

What is CVE-2026-104016?

The vulnerability in ProtobufParser arises from improper handling of length-prefixed protobuf strings and byte arrays, which can lead to integer overflow. When an attacker supplies a varint that decodes to a length near Integer.MAX_VALUE, it causes the pointer arithmetic (_inputPtr + len) to overflow and revert to a negative value. This failure in bounds checking allows the call to _finishShortText(len) to proceed and triggers an OutOfMemoryError when attempting to expand the TextBuffer array. Notably, the JVM enforces strict limits on array sizes, which cannot exceed Integer.MAX_VALUE - 8, making the issue not mitigated by standard heap tuning options. This vulnerability does not require special privileges or user interaction beyond merely submitting parsing data, rendering it particularly concerning.

References