{"id":"CVE-2026-106554","kind":"vulnerability","aliases":["CVE-2026-106554"],"related":[],"title":"Jackson CBOR parser: stacked tags cause quadratic CPU and memory use","description":"One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).","summary":"A crafted CBOR input with a long run of semantic tags makes jackson-dataformat-cbor grow its tag list in fixed steps, so parsing time grows quadratically. An attacker can tie up request threads and garbage collection with a modest payload.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend","cbor","jackson","java","package"],"not_affected_if":["no-untrusted-cbor-input"],"how_to_check":"- Check the version of `com.fasterxml.jackson.dataformat:jackson-dataformat-cbor` in your dependency tree, for example with `mvn dependency:tree` or `gradle dependencies`.\n- Look for CBOR parsing of untrusted input in request handlers.","fix":null,"status":"open","published_at":"2026-11-04T16:17:32+00:00","first_seen_at":"2026-11-04T16:28:10+00:00","triaged_at":"2026-11-04T16:29:02+00:00","updated_at":"2026-11-04T16:29:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T16:29:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Jackson CBOR parser: stacked tags cause quadratic CPU and memory use","impact":"low","summary":"A crafted CBOR input with a long run of semantic tags makes jackson-dataformat-cbor grow its tag list in fixed steps, so parsing time grows quadratically. An attacker can tie up request threads and garbage collection with a modest payload.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","jackson","cbor","backend"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"request threads pinned and memory pool exhausted by crafted input","analyst_note":"Find whether a fixed release of jackson-dataformat-cbor exists; check the linked GitHub advisory for the affected and patched version ranges.","how_to_check":"- Check the version of `com.fasterxml.jackson.dataformat:jackson-dataformat-cbor` in your dependency tree, for example with `mvn dependency:tree` or `gradle dependencies`.\n- Look for CBOR parsing of untrusted input in request handlers.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-cbor-input"],"who_is_affected":"Applications that parse CBOR from untrusted sources using the Jackson CBOR module are exposed, since the flaw is triggered by input alone. The sources report a proof of concept against 2.18.2 and say the issue is present in current 2.x and 3.x HEAD; the sources do not state a fixed version. Services that never decode CBOR from outside callers can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4663,"output_tokens":605,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+8':173C '-106554':14A,17A '-2026':13A,16A '-407':276C '/cbor/cborparser.java':139C '/copies':181C '0xc0':242C '17':227C '2':107C,209C '2.18.2':103C '3':110C 'accumul':160C,204C 'advisori':120C 'algorithm':270C 'algorithmic-complex':269C 'and/or':300C 'array':167C 'attack':52B,186C 'avro':117C 'back':166C 'backend':18B 'binari':74C 'byte':197C,239C 'cap':217C,301C 'caus':6A 'cbor':2A,19B,25B,38B,67C,76C,82C,102C,132C,143C,158C,230C 'cbor-pars':66C 'cbor/src/main/java':138C 'chain':130C 'collect':60B 'com.fasterxml.jackson.dataformat':98C 'complex':271C 'concurr':290C 'configur':266C 'consist':232C 'consum':283C 'count':259C 'cpu':8A 'cpu/gc':125C,249C,285C 'cpu/gc-exhaustion':90C 'craft':24B 'current':106C 'cve':12A,15A 'cwe':275C 'data':146C 'dataformat':37B,73C,101C 'denial':272C 'distinct':114C 'dos':91C,126C 'doubl':176C,299C 'drive':84C 'e.g':240C 'execut':96C,225C 'exhaust':292C 'feed':228C 'file':137C 'fix':44B,171C,200C,295C 'fixed-incr':199C 'forc':247C 'garbag':59B 'gc':213C 'grow':39B,49B,168C,252C,296C 'growth':89C,184C,202C 'handl':141C 'head':113C 'impact':268C 'increment':172C,201C 'input':26B,279C 'issu':69C 'item':147C 'jackson':1A,20B,36B,72C,100C 'jackson-dataformat-cbor':35B,99C 'jackson-dataformats-binari':71C 'java':21B 'jdk':226C 'limit':267C 'linear':255C 'list':42B 'long':29B,193C,235C 'make':34B,203C 'memori':10A 'modest':63B,278C 'modul':77C 'n':205C,208C 'number':153C,220C,303C 'o':207C 'one':65C 'packag':22B 'pars':47B,68C,250C 'parser':3A,159C 'payload':64B 'permit':144C 'pin':260C,286C 'plus':212C 'poc':93C,95C,135C,224C 'poc-proven':92C,134C 'pool':294C 'preced':150C,190C 'present':104C 'pressur':214C 'proven':94C,136C 'quadrat':7A,50B,86C,124C,248C,284C 'quadratic-tim':85C 're':179C 're-scan':178C 'repo':123C 'request':56B,262C,288C,291C 'run':30B,80C,194C,236C 'scan':180C 'semant':32B,155C 'send':187C 'servic':274C 'smile/protobuf':119C 'stack':4A,222C,281C,305C 'step':45B 'stream':231C 'streamreadconstraint':308C 'streamreadconstraints-styl':307C 'style':309C 'super':254C 'super-linear':253C 'tag':5A,33B,41B,83C,133C,140C,156C,196C,206C,223C,238C,241C,258C,282C,306C 'taglist':88C,142C,164C,297C 'thread':57B,263C,289C 'tie':54B 'time':48B,87C,211C,251C 'tools.jackson.dataformat.cbor':112C 'trivial':245C 'unbound':79C,129C 'use':11A 'valu':189C,246C 'whose':165C 'x':108C,111C","nicknames":[],"mitigations":[],"who_affected":"Applications that parse CBOR from untrusted sources using the Jackson CBOR module are exposed, since the flaw is triggered by input alone. The sources report a proof of concept against 2.18.2 and say the issue is present in current 2.x and 3.x HEAD; the sources do not state a fixed version. Services that never decode CBOR from outside callers can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backend","cbor","jackson","java","medium","package"],"campaign_type":null,"first_public_at":"2026-10-22T21:30:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106554","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106554","severity":null,"published_at":"2026-11-04T16:17:32+00:00","modified_at":"2026-11-04T16:17:32+00:00","first_seen_at":"2026-11-04T16:28:10+00:00","fetched_at":"2026-11-04T16:28:10+00:00","note":null}],"documents":[{"id":68468,"url":"https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T21:30:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}