Live › vulnerability › CVE-2026-104016
Go to dashboardThe Jackson protobuf parser reads string and bytes length fields with 32-bit integer arithmetic, so a large length value overflows its bounds check. The parser then tries to allocate an array the JVM cannot create, throwing OutOfMemoryError. An attacker who can submit protobuf data for parsing can crash the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 00:29 UTC. All times on this page are UTC.
Services that parse untrusted protobuf input with Jackson's protobuf module are exposed, because the payload reaches the vulnerable string path directly. StreamReadConstraints limits do not block it, so configuring them is not a mitigation. Services that do not parse protobuf through Jackson can skip it.
No product ranges from the sources yet.
mvn dependency:tree or gradle dependenciesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit.
The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured.
A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.
This page as .md · .json · in your agent: get_signal("CVE-2026-104016")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.