Buffer Overflow in Jackson Dataformats Binary Parser by FasterXML

CVE-2026-68496

What is CVE-2026-68496?

The Smile parser in the FasterXML jackson-dataformats-binary library contains a vulnerability where it fails to validate the length of JSON object property names. This oversight allows an attacker to input a property name of unlimited length, leading to potential memory exhaustion. The inherent lack of restriction can result in denial of service due to excessive memory consumption, particularly when the default configurations are used. As the parser does not enforce the maximum name length limit during the decoding process, systems leveraging this library are at risk if they accept data from untrusted sources. Users are advised to upgrade to versions 2.16.0 or later, which implement necessary constraints.

References