CVE-2026-104016

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. (affected versions not specified)

Description An integer overflow occurs in the ProtobufParser when parsing length-prefixed protobuf string and bytes fields. The parser uses 32-bit signed integer arithmetic to check if ( inputPtr + len) <= inputEnd. If an attacker provides a varint that decodes to a length near Integer.MAX VALUE, the addition overflows to a negative value, allowing the bounds check to pass. Subsequently, the finishShortText(len) function calls TextBuffer.expandCurrentSegment(len), which triggers Arrays.copyOf and results in an OutOfMemoryError because the requested array size exceeds the JVM limit. This issue persists regardless of -Xmx tuning or configurations for StreamReadConstraints.maxStringLength and maxDocumentLength. No privileges or user interaction are required beyond the ability to submit data for parsing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.