Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-110747— jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

Quick assessment

Affected
FasterXML jackson-dataformat-protobuf
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

方法将 Protobuf 映射条目字符串键的长度前缀读取到由攻击者控制的 变量中，随后使用有符号算术执行检查 。当 的值接近 时，加法运算会发生溢出，导致结果变为负数，从而使该检查即使在没有实际键数据的情况下也能通过。随后，解析器会调用 ，该方法通过 和 将文本缓冲区扩展至声明的长度，最终抛出 （请求的数组大小超出虚拟机限制）。 仅包含 8 字节的畸形消息（其中映射条目的声明键长度为 ）即足以触发此漏洞。即使配置了 （包括 、 、 和 ），也无法阻止该故障发生。对于以 参数运行的应用程序，JVM 将直接终止。 此问

CVSS 7.5 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-110747

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload
Source: CVE Program / CVE List V5
Vulnerability Description
ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit. An 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM. This is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
FasterXML jackson-dataformat-protobuf 2.21.6 ~ 2.21.8 -
FasterXML jackson-dataformat-protobuf 3.1.6 ~ 3.1.8 -

II. Public POCs for CVE-2026-110747

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-110747

请登录查看更多情报信息。

Other References for CVE-2026-110747 (1)

Same Patch Batch · FasterXML · 2026-10-28 · 3 CVEs total

CVE-2026-110879 9.8 CRITICAL jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array ele
CVE-2026-104895 7.5 HIGH jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async pa

IV. Related Vulnerabilities

Same product: jackson-dataformat-protobuf
Same vendor: FasterXML
Same weakness: CWE-190