---
id: "CVE-2026-110747"
kind: "vulnerability"
aliases: ["CVE-2026-110747"]
title: "Jackson protobuf parser: 8-byte message crashes JVM with OutOfMemoryError"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backend-services", "jackson", "java", "jvm", "package", "protobuf"]
not_affected_if: ["jackson-2.18-to-2.20", "jackson-3.0-or-3.1.0-3.1.5-or-3.2.0-3.2.1", "no-untrusted-protobuf-input"]
published_at: "2026-10-28T01:16:55+00:00"
first_seen_at: "2026-10-28T01:30:10+00:00"
updated_at: "2026-10-28T01:31:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110747", "first_seen_at": "2026-10-28T01:30:10+00:00"}]
---

# Jackson protobuf parser: 8-byte message crashes JVM with OutOfMemoryError

A malformed protobuf message with a map key length near Integer.MAX_VALUE overflows an integer check in ProtobufParser._readStringKey(), causing the parser to try allocating a huge buffer. The resulting OutOfMemoryError can terminate the JVM when the application runs with -XX:+ExitOnOutOfMemoryError, giving an attacker a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the Jackson protobuf module version in the build file or `mvn dependency:tree` output and see whether it is on the 2.x line at 2.21.6 or later, or on the 3.1.6 / 3.2.2 lines or later.
- Confirm the application parses untrusted protobuf input with ProtobufMapper or the jackson-dataformat-protobuf module.
- Check whether JVM flags include `-XX:+ExitOnOutOfMemoryError`.

## Fix

- Upgrade jackson-dataformat-protobuf to a release that contains the map-key guard: the 3.x line fix is in 3.1.6 or 3.2.2 or later, and the 2.x line is fixed in a release after the unguarded 2.x branches (the sources do not give the exact 2.x fixed version).
- Until upgraded, reject or size-limit untrusted protobuf input before parsing.

## Timeline

- 2026-10-28T01:30:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110747

## From the sources

ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.



An 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.



This is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_