com.fasterxml.jackson.dataformat/jackson-dataformat-smile vulnerabilities

Latest com.fasterxml.jackson.dataformat/jackson-dataformat-smile CVEs

Newest publication first

1. CVE-2026-104895 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

   Published 2026-10-28

   High·CVSS 7.5 EPSS 0.38%

   The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i &...

2. CVE-2026-68496 jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

   Published 2026-10-01

   High·CVSS 7.5 EPSS 0.56%

   The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName() grows its internal name buffe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.