Apvxlab

A denial of service issue exists in the CBOR module of jackson-dataformats-binary due to an algorithmic complexity flaw. The `CBORParser.java` file handles CBOR tags using a `TagList` whose backing array grows by a fixed increment rather than doubling. When an attacker provides a value preceded by an excessively long sequence of tag bytes, the process of accumulating these tags results in quadratic time complexity O(N^2) for CPU and garbage collection (GC) usage. This can lead to CPU and GC exhaustion, pinning request threads and potentially exhausting the request pool.

The asynchronous Smile parser `NonBlockingByteArrayParser` allocates a byte array based on a raw-binary length prefix from untrusted input without an upper bound or overflow check. Specifically, when encountering the raw-binary marker 0xFD, the ` decodeVInt()` function calculates the length without the overflow guard used in the blocking `SmileParser. readUnsignedVInt` function. Subsequently, ` startRawBinary` allocates the specified length immediately. This can allow a small input to trigger a massive memory allocation, leading to an `OutOfMemoryError` on reactive or asynchronous Smile endpoints. Additionally, a crafted VInt (Variable Integer) that overflows an integer can result in a negative length, causing a `NegativeArraySizeException`. Both scenarios can crash the request or processing thread.

An unbounded memory allocation issue exists where attackers can exhaust JVM memory by declaring a large uncompressed length in compressed input. By providing crafted bytes to the `uncompress()`, `uncompressString()`, `SnappyInputStream`, or `SnappyFramedInputStream` functions, an attacker can force allocations up to 2 GB, leading to an OutOfMemoryError and a denial of service.