{"id":"CVE-2026-104016","kind":"vulnerability","aliases":["CVE-2026-104016"],"related":[],"title":"Jackson protobuf module: crafted length field triggers out-of-memory crash","description":"ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit.\n\n\n\nThe JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured.\n\n\n\nA February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.","summary":"The Jackson protobuf parser reads string and bytes length fields with 32-bit integer arithmetic, so a large length value overflows its bounds check. The parser then tries to allocate an array the JVM cannot create, throwing OutOfMemoryError. An attacker who can submit protobuf data for parsing can crash the service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jackson","java","package","protobuf","self-hosted"],"not_affected_if":["no-protobuf-parsing"],"how_to_check":"- Check whether the project depends on the Jackson protobuf data format module (ProtobufParser), for example with `mvn dependency:tree` or `gradle dependencies`\n- unknown: the sources do not list affected versions","fix":"- unknown: the sources do not name a fixed version; check the Jackson project's release notes for a release after the February 2026 overflow-guard commit","status":"open","published_at":"2026-10-28T00:17:10+00:00","first_seen_at":"2026-10-28T00:29:54+00:00","triaged_at":"2026-10-28T00:31:36+00:00","updated_at":"2026-10-28T00:31:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T00:31:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version; check the Jackson project's release notes for a release after the February 2026 overflow-guard commit","reach":"unknown","title":"Jackson protobuf module: crafted length field triggers out-of-memory crash","impact":"medium","summary":"The Jackson protobuf parser reads string and bytes length fields with 32-bit integer arithmetic, so a large length value overflows its bounds check. The parser then tries to allocate an array the JVM cannot create, throwing OutOfMemoryError. An attacker who can submit protobuf data for parsing can crash the service.","category":"package","nicknames":[],"who_cares":["java","jackson","protobuf","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote denial of service via out-of-memory crash","analyst_note":"","how_to_check":"- Check whether the project depends on the Jackson protobuf data format module (ProtobufParser), for example with `mvn dependency:tree` or `gradle dependencies`\n- unknown: the sources do not list affected versions","needs_analyst":false,"not_affected_if":["no-protobuf-parsing"],"who_is_affected":"Services that parse untrusted protobuf input with Jackson's protobuf module are exposed, because the payload reaches the vulnerable string path directly. StreamReadConstraints limits do not block it, so configuring them is not a mitigation. Services that do not parse protobuf through Jackson can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001036,"input_tokens":3688,"output_tokens":1335,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104016':15A,18A '-2026':14A,17A '2026':222C '32':37B,103C '33':183C '8':161C 'abil':257C 'add':225C 'alloc':55B,205C 'arithmet':40B,107C 'array':57B,148C,156C,234C 'arrays.copyof':140C 'artifact':212C 'attack':65B,110C 'avail':164C 'beyond':255C 'bit':38B,104C 'bound':48B,129C 'byte':33B,85C,184C 'call':98C,247C 'cannot':60B 'cap':143C,193C 'check':49B,88C,130C,199C 'commit':224C 'configur':219C 'confirm':208C 'consult':163C 'craft':4A 'crash':12A,74B 'creat':61B 'cve':13A,16A 'data':70B,260C 'decod':114C 'document':191C 'document-length':190C 'empir':209C 'equival':227C 'exceed':150C 'far':187C 'fast':96C 'februari':221C 'field':6A,35B,86C 'finishshorttext':99C,133C 'fire':202C 'gate':179C 'guard':229C 'harden':223C 'heap':165C 'host':25B 'inputend':91C 'inputptr':89C,121C 'integ':39B,106C 'integer.max':119C,159C 'interact':254C 'issu':173C 'jackson':1A,19B,27B 'java':20B 'jvm':59B,154C 'larg':43B 'larger':157C 'left':242C 'len':90C,100C,122C,134C,137C 'length':5A,34B,44B,80C,117C,192C,198C,235C,239C,246C 'length-prefix':79C 'limit':152C 'maxdocumentlength':176C,215C 'maxnestingdepth':217C 'maxstringlength':214C 'memori':11A 'messag':238C 'message-length':237C 'mitig':171C 'modul':3A 'near':118C 'negat':126C 'out-of-memori':8A 'outofmemoryerror':63B,146C 'overflow':46B,123C,228C 'pack':233C 'packag':21B 'packed-array-length':232C 'pars':72B,78C,262C 'parser':29B,51B 'pass':131C 'path':97C,181C,240C 'payload':185C 'perform':139C 'prefix':81C 'privileg':251C 'protobuf':2A,22B,28B,69B,82C 'protobufpars':77C 'reach':135C 'read':30B 'refus':155C 'request':147C 'requir':264C 'self':24B 'self-host':23B 'servic':76B 'ship':211C 'sign':105C 'site':248C 'size':149C 'streamreadconstraints.maxstringlength':174C 'string':31B,83C,197C,245C 'string-length':196C,244C 'submit':68B,259C 'suppli':111C 'textbuffer.expandcurrentsegment':136C 'throw':62B,145C 'tri':53B 'trigger':7A 'tune':168C 'unguard':249C 'use':102C 'user':253C 'valu':45B,120C,127C,160C 'varint':113C 'vm':151C 'xmx':167C","nicknames":[],"mitigations":[],"who_affected":"Services that parse untrusted protobuf input with Jackson's protobuf module are exposed, because the payload reaches the vulnerable string path directly. StreamReadConstraints limits do not block it, so configuring them is not a mitigation. Services that do not parse protobuf through Jackson can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T00:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"36c7be3b-2937-45df-85ea-ca7133ea542c","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104016","severity":null,"published_at":"2026-10-28T00:17:10+00:00","modified_at":"2026-10-28T00:17:10+00:00","first_seen_at":"2026-10-28T00:29:54+00:00","fetched_at":"2026-10-28T00:29:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}