CVE-2026-106554

Name of the Vulnerable Software and Affected Versions jackson-dataformats-binary versions 2.x and 3.x

Description A denial of service issue exists in the CBOR module of jackson-dataformats-binary due to an algorithmic complexity flaw. The CBORParser.java file handles CBOR tags using a TagList whose backing array grows by a fixed increment rather than doubling. When an attacker provides a value preceded by an excessively long sequence of tag bytes, the process of accumulating these tags results in quadratic time complexity O(N^2) for CPU and garbage collection (GC) usage. This can lead to CPU and GC exhaustion, pinning request threads and potentially exhausting the request pool.

Recommendations Update jackson-dataformats-binary to a version where the TagList grows by doubling or where a cap is implemented on the number of stacked tags.