CVE-2026-106554— jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

Quick assessment

Affected

FasterXML jackson-dataformat-cbor

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

jackson-dataformats-binary 的 CBOR 模块中存在一个 CBOR 解析问题：无限制的 CBOR 标签序列会导致 TagList 以二次方时间增长，从而引发 CPU 或垃圾回收（GC）耗尽型拒绝服务（DoS）攻击，且已有概念验证（PoC）证实。该 PoC 已在 com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2 版本上成功执行；此漏洞同样存在于当前 2.x 和 3.x 分支（tools.jackson.dataf

AI Predicted 5.3 Difficulty: Trivial Updated Nov 05, 2026

Possible ATT&CK Techniques 2 AI

T1190 · Exploit Public-Facing Application T1499.003 · Application Exhaustion Flood

Affected Version Matrix 10

Vendor	Product	Version Range	Status
FasterXML	jackson-dataformat-cbor	`2.15.0< 2.18.12`	affected
		`2.18.12`	unaffected
		`2.19.0< 2.21.8`	affected
		`2.21.8`	unaffected
		`2.22.0< 2.22.4`	affected
		`2.22.4`	unaffected
		`3.0.0< 3.1.8`	affected
		`3.1.8`	unaffected
… +2 more rows

Updated Nov 05, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

Source: CVE Program / CVE List V5

Vulnerability Description

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList). CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags. PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit. Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool. Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

算法复杂性

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
FasterXML	jackson-dataformat-cbor	2.15.0 ~ 2.18.12	-
FasterXML	jackson-dataformat-cbor	3.0.0 ~ 3.1.8	-

II. Public POCs for CVE-2026-106554

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-106554

请登录查看更多情报信息。

Other References for CVE-2026-106554 (1)

https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927 vendor-advisory

https://www.cve.org/CVERecord?id=CVE-2026-106554

IV. Related Vulnerabilities

Same vendor: FasterXML

Same weakness: CWE-407