CVE-2026-104895

Name of the Vulnerable Software and Affected Versions Jackson (affected versions not specified)

Description The asynchronous Smile parser NonBlockingByteArrayParser allocates a byte array based on a raw-binary length prefix from untrusted input without an upper bound or overflow check. Specifically, when encountering the raw-binary marker 0xFD, the decodeVInt() function calculates the length without the overflow guard used in the blocking SmileParser. readUnsignedVInt function. Subsequently, startRawBinary allocates the specified length immediately. This can allow a small input to trigger a massive memory allocation, leading to an OutOfMemoryError on reactive or asynchronous Smile endpoints. Additionally, a crafted VInt (Variable Integer) that overflows an integer can result in a negative length, causing a NegativeArraySizeException. Both scenarios can crash the request or processing thread.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.