{"id":"CVE-2026-110747","kind":"vulnerability","aliases":["CVE-2026-110747"],"related":[],"title":"Jackson protobuf parser: 8-byte message crashes JVM with OutOfMemoryError","description":"ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.\n\n\n\nAn 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.\n\n\n\nThis is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.","summary":"A malformed protobuf message with a map key length near Integer.MAX_VALUE overflows an integer check in ProtobufParser._readStringKey(), causing the parser to try allocating a huge buffer. The resulting OutOfMemoryError can terminate the JVM when the application runs with -XX:+ExitOnOutOfMemoryError, giving an attacker a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend-services","jackson","java","jvm","package","protobuf"],"not_affected_if":["jackson-2.18-to-2.20","jackson-3.0-or-3.1.0-3.1.5-or-3.2.0-3.2.1","no-untrusted-protobuf-input"],"how_to_check":"- Check the Jackson protobuf module version in the build file or `mvn dependency:tree` output and see whether it is on the 2.x line at 2.21.6 or later, or on the 3.1.6 / 3.2.2 lines or later.\n- Confirm the application parses untrusted protobuf input with ProtobufMapper or the jackson-dataformat-protobuf module.\n- Check whether JVM flags include `-XX:+ExitOnOutOfMemoryError`.","fix":"- Upgrade jackson-dataformat-protobuf to a release that contains the map-key guard: the 3.x line fix is in 3.1.6 or 3.2.2 or later, and the 2.x line is fixed in a release after the unguarded 2.x branches (the sources do not give the exact 2.x fixed version).\n- Until upgraded, reject or size-limit untrusted protobuf input before parsing.","status":"open","published_at":"2026-10-28T01:16:55+00:00","first_seen_at":"2026-10-28T01:30:10+00:00","triaged_at":"2026-10-28T01:31:42+00:00","updated_at":"2026-10-28T01:31:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T01:31:42Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade jackson-dataformat-protobuf to a release that contains the map-key guard: the 3.x line fix is in 3.1.6 or 3.2.2 or later, and the 2.x line is fixed in a release after the unguarded 2.x branches (the sources do not give the exact 2.x fixed version).\n- Until upgraded, reject or size-limit untrusted protobuf input before parsing.","reach":"internet","title":"Jackson protobuf parser: 8-byte message crashes JVM with OutOfMemoryError","impact":"medium","summary":"A malformed protobuf message with a map key length near Integer.MAX_VALUE overflows an integer check in ProtobufParser._readStringKey(), causing the parser to try allocating a huge buffer. The resulting OutOfMemoryError can terminate the JVM when the application runs with -XX:+ExitOnOutOfMemoryError, giving an attacker a denial of service.","category":"package","nicknames":[],"who_cares":["java","jackson","protobuf","jvm","backend-services"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote input crashes the JVM, taking the service offline.","analyst_note":"Confirm the exact fixed 2.x version for the unguarded branches from the NVD entry or the upstream Jackson release notes; the sources do not name it.","how_to_check":"- Check the Jackson protobuf module version in the build file or `mvn dependency:tree` output and see whether it is on the 2.x line at 2.21.6 or later, or on the 3.1.6 / 3.2.2 lines or later.\n- Confirm the application parses untrusted protobuf input with ProtobufMapper or the jackson-dataformat-protobuf module.\n- Check whether JVM flags include `-XX:+ExitOnOutOfMemoryError`.","needs_analyst":true,"not_affected_if":["no-untrusted-protobuf-input","jackson-2.18-to-2.20","jackson-3.0-or-3.1.0-3.1.5-or-3.2.0-3.2.1"],"who_is_affected":"Applications that deserialize untrusted protobuf data with the Jackson protobuf dataformat module are exposed, since a single small message is enough to trigger the failure. The sources say the 2.x branches are unguarded for this call site, while the 3.0 line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain the affected method, and 2.18, 2.19 and 2.20 do not contain it either. Services that do not parse protobuf from untrusted sources can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000846,"input_tokens":3799,"output_tokens":933,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-104016':211C '-104017':215C '-110747':13A,16A '-2026':12A,15A,210C,214C '0x7fffffff':167C '2':233C,302C '2.18':239C '2.19':240C '2.20':242C '2.21.6':299C '3':226C '3.0':270C '3.1.0':274C '3.1.5':275C '3.1.6':292C '3.2.0':276C '3.2.1':277C '3.2.2':294C '8':4A,153C 'abil':261C 'addit':107C 'address':199C 'affect':250C,286C 'alloc':48B 'appear':290C 'applic':61B,183C 'arithmet':100C 'array':147C 'arrays.copyof':143C 'associ':207C 'attack':68B,89C 'attacker-control':88C 'backend':18B 'backend-servic':17B 'beyond':259C 'branch':228C,235C 'buffer':51B,135C 'byte':5A,154C 'call':128C,202C,220C 'caus':43B 'check':40B,94C,115C 'configur':170C 'contain':121C,157C,245C,280C 'control':90C 'correct':223C 'correspond':232C 'crash':7A 'cve':11A,14A,209C,213C 'data':124C,264C 'declar':138C,163C 'denial':70B 'entri':82C,160C 'even':117C 'exceed':149C 'exitonoutofmemoryerror':65B,187C 'expand':132C 'failur':182C 'finishshorttext':129C 'first':289C 'give':66B 'huge':50B 'includ':172C 'input':120C 'inputend':97C 'inputptr':95C 'int':91C 'integ':39B,196C 'integer-overflow':195C 'integer.max':35B,104C 'interact':258C 'introduct':297C 'jackson':1A,20B 'java':21B 'jvm':8A,22B,58B,190C 'key':32B,85C,123C,164C,219C 'leav':230C 'len':96C,130C 'length':33B,76C,139C,165C 'limit':151C 'line':238C,272C 'malform':26B,155C 'map':31B,81C,159C,218C 'map-key':217C 'maxdocumentlength':175C 'maxnamelength':174C 'maxnestingdepth':177C 'maxstringlength':173C 'messag':6A,28B,156C 'method':288C 'mirror':295C 'near':34B,103C 'negat':111C 'outofmemoryerror':10A,54B,145C 'overflow':37B,108C,197C 'packag':23B 'pars':266C 'parser':3A,45B,126C 'pass':116C 'pattern':198C 'prefix':77C 'prevent':180C 'privileg':255C 'protobuf':2A,24B,27B,80C 'protobufparser._readstringkey':42B,73C 'read':74C 'readstringkey':246C,281C 'releas':237C,271C 'remedi':206C 'request':146C 'requir':268C 'result':53B 'run':62B,184C 'servic':19B,72B 'side':304C 'sign':99C 'site':203C,221C 'size':148C 'streamreadconstraint':171C 'string':84C 'submit':263C 'suffici':169C 'termin':56B,188C 'text':134C 'textbuffer.expandcurrentsegment':141C 'therefor':284C 'throw':144C 'tri':47B 'unguard':236C 'use':98C 'user':257C 'valu':36B,102C,105C,112C 'vector':253C 'via':140C 'vm':150C 'x':227C,234C,303C 'xx':64B,186C","nicknames":[],"mitigations":[],"who_affected":"Applications that deserialize untrusted protobuf data with the Jackson protobuf dataformat module are exposed, since a single small message is enough to trigger the failure. The sources say the 2.x branches are unguarded for this call site, while the 3.0 line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain the affected method, and 2.18, 2.19 and 2.20 do not contain it either. Services that do not parse protobuf from untrusted sources can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T01:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"36c7be3b-2937-45df-85ea-ca7133ea542c","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110747","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110747","severity":null,"published_at":"2026-10-28T01:16:55+00:00","modified_at":"2026-10-28T01:16:55+00:00","first_seen_at":"2026-10-28T01:30:10+00:00","fetched_at":"2026-10-28T01:30:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}