Denial of Service Risk in Jackson Dataformat CBOR Module by FasterXML

CVE-2026-106554

What is CVE-2026-106554?

The vulnerability in the jackson-dataformats-binary's CBOR module allows an unbounded chain of CBOR tags to cause quadratic growth in processing time and memory consumption, leading to denial of service. Attackers can exploit this issue by sending specially crafted CBOR streams consisting of a long sequence of tag bytes, which results in the server experiencing significant CPU and garbage collection pressure, potentially pinning request threads and exhausting available resources. A remedial solution includes implementing algorithmic enhancements to manage tag growth more effectively.

References