CVE-2026-104895— jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

Quick assessment

Affected

FasterXML jackson-dataformat-smile

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

异步 Smile 解析器（NonBlockingByteArrayParser）会从不可信输入中读取原始二进制长度前缀，并据此在读取数据体之前分配一个 byte[] 数组。该过程既未设置上限，也未进行溢出检查。具体而言，在遇到原始二进制标记 0xFD 时，_decodeVInt() 方法会计算 (value << 6) + (i & 0x3F)，但缺少阻塞式 SmileParser 中 _readUnsignedVInt 方法所具备的 (value >>> 25) != 0 溢出防护机制；随后，_startRawB

CVSS 7.5 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service

Source: CVE Program / CVE List V5

Vulnerability Description

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

未经控制的内存分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FasterXML	jackson-dataformat-smile	2.9.0 ~ 2.18.12	-
FasterXML	jackson-dataformat-smile	3.0.0 ~ 3.1.8	-

II. Public POCs for CVE-2026-104895

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-104895

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-104895 (1)

🔗 Smile async parser (NonBlockingByteArrayParser): unbounded/overflowing eager byte[] for raw binary (OOM DoS) [CVE-2026-104895] · Advisory · FasterXML/jackson-dataformats-binary · GitHub vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-104895

Same Patch Batch · FasterXML · 2026-10-28 · 3 CVEs total

CVE-2026-110879	9.8 CRITICAL	jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array ele
CVE-2026-110747	7.5 HIGH	jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows Ou

IV. Related Vulnerabilities

Same vendor: FasterXML

Same weakness: CWE-789