Skip to content
Fencer Intel
high 7.5

CVE-2026-104895 json

jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

published 13d ago modified 5d ago also EUVD-2026-111530

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 32%
public exploits
0
none known

Summary

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.

A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.

This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

Patch / fix

  • FasterXML jackson-dataformat-smile 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4
  • jackson-dataformats-binary Debian 14 2.22.4-1

debian advisories DEBIAN-CVE-2026-104895

Is CVE-2026-104895 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-104895 updated cvss 7.5

com.fasterxml.jackson.dataformat/jackson-dataformat-smile: jackson-dataformat-smile: Denial of Service via unbounded memory allocation in asynchronous parser

  • Red Hat build of Apache Camel for Spring Boot 4 jackson-dataformat-smile 2.21.4.redhat-00002
    affected: no fix available
  • Red Hat Fuse 7 jackson-dataformat-smile 2.21.4.redhat-00002
    affected: no fix available “Fix deferred”
  • Red Hat Satellite 6.16 for RHEL 8 python-pyyaml 6.0.1-1.el8pc, openvox-server 8.18.0-1.el8sat, python3.11-pyyaml 6.0.1-1.el8pc Red Hat Satellite 6.16 for RHEL 9 python-pyyaml 6.0.1-1.el9pc, openvox-server 8.18.0-1.el9sat, python3.11-pyyaml 6.0.1-1.el9pc
    fixed: vendor fix RHSA-2026:95655
  • Red Hat Satellite 6.17 for RHEL 9 openvox-server 8.18.0-1.el9sat
    fixed: vendor fix RHSA-2026:95656
  • Red Hat Satellite 6.18 for RHEL 9 openvox-server 8.18.0-1.el9sat
    fixed: vendor fix RHSA-2026:95657
  • Red Hat Satellite 6.19 for RHEL 9 openvox-server 8.18.0-1.el9sat
    fixed: vendor fix RHSA-2026:95652
  • Red Hat Enterprise Linux 8 jackson-jaxrs-providers, jackson-jaxrs-json-provider, jackson-jaxrs-providers-parent, jackson-jaxrs-providers-javadoc, jackson-jaxrs-providers-datatypes Red Hat Enterprise Linux 9 jackson-jaxrs-providers, pki-jackson-jaxrs-providers, pki-jackson-jaxrs-json-provider
    not affected: vulnerable code not present
  • Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9
    not affected: vulnerable code not in execute path
show 1 more
  • Red Hat Satellite 6.16 for RHEL 8 python-nh3 0.3.0-2.el8pc, python-brotli 1.2.1-1.el8pc, python-django 4.2.30-2.el8pc, python-pillow 13.0.0-1.el8pc, python-urllib3 2.8.0-1.el8pc, python3.11-nh3 0.3.0-2.el8pc, +11 more Red Hat Satellite 6.16 for RHEL 9 python-nh3 0.3.0-2.el9pc, python-brotli 1.2.1-1.el9pc, python-django 4.2.30-2.el9pc, python-pillow 13.0.0-1.el9pc, python-urllib3 2.8.0-1.el9pc, python3.11-nh3 0.3.0-2.el9pc, +11 more Red Hat Satellite 6.17 for RHEL 9 python-brotli 1.2.1-1.el9pc, python-django 4.2.30-2.el9pc, python-pillow 13.0.0-1.el9pc, python-urllib3 2.8.0-1.el9pc, openvox-agent 8.32.0-1.el9sat, python-gitpython 3.2.1-1.el9pc, +7 more Red Hat Satellite 6.18 for RHEL 9 openvox-agent 8.32.0-1.el9sat, python3.12-brotli 1.2.1-1.el9pc, python3.12-django 4.2.30-3.el9pc, python3.12-pillow 13.0.0-1.el9pc, python3.12-urllib3 2.8.0-1.el9pc, python3.12-gitpython 3.2.1-1.el9pc, +2 more Red Hat Satellite 6.19 for RHEL 9 openvox-agent 8.32.0-1.el9sat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
5d ago

Exploit prediction

0.38% chance of exploitation in the next 30 days, higher than 32% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • FasterXML jackson-dataformat-smile

Classification

Weakness
  • CWE-789 Memory Allocation with Excessive Size Value

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.