CVE-2026-106554 · Package
NO FIX YET
A crafted CBOR input with a long run of semantic tags makes jackson-dataformat-cbor grow its tag list in fixed steps, so parsing time grows quadratically. An attacker can tie up request threads and garbage collection with a modest payload.
first public Oct 22, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Applications that parse CBOR from untrusted sources using the Jackson CBOR module are exposed, since the flaw is triggered by input alone. The sources report a proof of concept against 2.18.2 and say the issue is present in current 2.x and 3.x HEAD; the sources do not state a fixed version. Services that never decode CBOR from outside callers can skip it.
Not affected if no-untrusted-cbor-input
Who cares backend, cbor, jackson, java
com.fasterxml.jackson.dataformat:jackson-dataformat-cbor in your dependency tree, for example with mvn dependency:tree or gradle dependencies.Unknown from the sources.
One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).
PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.
Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).
CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.
PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.
Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.
Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).
This page as .md · .json · in your agent: get_signal("CVE-2026-106554")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.