Memory Exhaustion Vulnerability in FasterXML Jackson Dataformats

CVE-2026-68495

What is CVE-2026-68495?

The CBOR parser in FasterXML's jackson-dataformats-binary contains a vulnerability that allows attackers to submit CBOR documents with property names of unbounded length. This occurs because the parser does not enforce the maxNameLength limit during the decoding of JSON object property names. As a result, attackers can cause memory exhaustion, leading to a denial of service. The issue impacts all versions prior to 2.16.0. If exploited, the limits imposed on property names are dictated only by the attacker's ability to upload data and the available system memory.

References