Package · Ubuntu

jackson-dataformat-smile

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Feed

High 7.5

CVE-2026-68496

jackson-dataformats-binary: Smile parser does not enforce StreamReadConstraints.maxNameLength, enabling memory-exhaustion denial of service

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName() grows it…

FasterXML jackson-dataformats-binary jackson-dataformat-smile jackson-dataformat-smile Debian Ubuntu

Oct 1, 2026