---
id: "CVE-2026-104895"
kind: "vulnerability"
aliases: ["CVE-2026-104895"]
title: "Jackson Smile parser: crafted input forces huge allocation, crashes async endpoints"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jackson", "java", "package", "reactive", "smile-format", "spring-webflux"]
not_affected_if: ["blocking-parser-only", "no-smile-input"]
published_at: "2026-10-28T00:17:11+00:00"
first_seen_at: "2026-10-28T00:29:54+00:00"
updated_at: "2026-10-28T00:31:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104895", "first_seen_at": "2026-10-28T00:29:54+00:00"}]
---

# Jackson Smile parser: crafted input forces huge allocation, crashes async endpoints

The asynchronous Smile parser (NonBlockingByteArrayParser) trusts a length prefix from input and allocates that many bytes before reading the body, with no upper bound or overflow check. A roughly ten-byte Smile feed can trigger about 2 GB of allocation (OutOfMemoryError) or a negative length (NegativeArraySizeException), crashing the request or processing thread.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the project depends on the Jackson Smile dataformat, for example with `mvn dependency:tree` or `gradle dependencies` and look for jackson-dataformat-smile.
- Check whether any reactive or asynchronous endpoint parses Smile input through the non-blocking parser.
- Check the installed jackson-dataformat-smile version against the affected range in the advisory (unknown from the sources).

## Fix

- Upgrade jackson-dataformat-smile to the patched release listed in the advisory (unknown from the sources).
- Until patched, reject or stop accepting Smile input on asynchronous endpoints.

## Timeline

- 2026-10-28T00:29:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104895

## From the sources

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.



A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.



This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_