Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104016— jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError

Quick assessment

Affected
FasterXML jackson-dataformat-protobuf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ProtobufParser 在解析带有长度前缀的 Protobuf 字符串和字节字段时，会先检查 ，随后在快速路径上调用 。这两处均使用 32 位有符号整数运算。当攻击者提供一个解码后长度接近 的变长整数（varint）时， 会发生整数上溢并变为负值，导致边界检查通过；随后 会调用 ，该函数执行无上限的 ，最终抛出 （请求的数组大小超出虚拟机限制）。 JVM 在检查可用堆内存之前，就会拒绝创建大于 的数组，因此调整 参数无法缓解此问题。此外， 中的 和 配置并未拦截此路径：仅 33 字节的载荷远低于任何文档长度上

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104016

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError
Source: CVE Program / CVE List V5
Vulnerability Description
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit. The JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured. A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FasterXML jackson-dataformat-protobuf 2.6.0 ~ 2.18.12 -
FasterXML jackson-dataformat-protobuf 3.0.0 ~ 3.1.8 -

II. Public POCs for CVE-2026-104016

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104016

请登录查看更多情报信息。

Other References for CVE-2026-104016 (1)

IV. Related Vulnerabilities

Same product: jackson-dataformat-protobuf
Same vendor: FasterXML
Same weakness: CWE-190