Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

V0Xyc0N

#40713of 60,391
7.5Total CVSS
Vulnerabilities · 1
PT-2026-137020
2026-11-04
7.5
CVE-2026-106554
Unknown
Jackson-Dataformats-Binary
A denial of service issue exists in the CBOR module of jackson-dataformats-binary due to an algorithmic complexity flaw. The `CBORParser.java` file handles CBOR tags using a `TagList` whose backing array grows by a fixed increment rather than doubling. When an attacker provides a value preceded by an excessively long sequence of tag bytes, the process of accumulating these tags results in quadratic time complexity O(N^2) for CPU and garbage collection (GC) usage. This can lead to CPU and GC exhaustion, pinning request threads and potentially exhausting the request pool.