DEBIAN-CVE-2026-104895
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-104895
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104895.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-104895
- Upstream
- Published
- 2026-10-28T00:17:11Z
- Modified
- 2026-11-08T01:00:07Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
- References
Affected packages
Debian:12 / jackson-dataformat-smile
Package
- Name
- jackson-dataformat-smile
- Purl
- pkg:deb/debian/jackson-dataformat-smile?arch=source&distro=bookworm
Debian:13 / jackson-dataformat-smile
Package
- Name
- jackson-dataformat-smile
- Purl
- pkg:deb/debian/jackson-dataformat-smile?arch=source&distro=trixie
Debian:14 / jackson-dataformats-binary
Package
- Name
- jackson-dataformats-binary
- Purl
- pkg:deb/debian/jackson-dataformats-binary?arch=source&distro=forky