Medium WID-SEC-2026-3702 2 CVEs

FasterXML Jackson: Mehrere Schwachstellen ermöglichen Denial of Service

Published Oct 1, 2026 · Updated Nov 3, 2026 · Revision 2 · de-DE

Vendor: FasterXML Vendor: IBM Product: Jackson Product: QRadar SIEM Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in FasterXML Jackson ausnutzen, um einen Denial of Service Angriff durchzuführen.

Product

Jackson ist eine quelloffene Bibliothek zur JSON-Verarbeitung in Java.

Vulnerabilities 2

High 7.5

CVE-2026-68495

jackson-dataformats-binary: CBOR parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLongerName() decodes a def…

FasterXML jackson-dataformats-binary jackson-dataformat-cbor jackson-dataformat-cbor Debian Ubuntu

Oct 1, 2026
High 7.5

CVE-2026-68496

jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName() grows it…

FasterXML jackson-dataformats-binary jackson-dataformat-smile jackson-dataformat-smile Debian Ubuntu

Oct 1, 2026

Revision history

2026-11-03 #2
Neue Updates von IBM aufgenommen
2026-10-01 #1
Initiale Fassung

References

GitHub Advisory Database vom 2026-10-01
https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-3v8f-v6vx-fmrm
GitHub Advisory Database vom 2026-10-01
https://github.com/advisories/GHSA-FVRX-R5JQ-295Q
IBM Security Bulletin 7295452 vom 2026-11-03
https://www.ibm.com/support/pages/node/7295452