CVE-2026-104015

Overview

jackson-dataformat-avro is the Apache Avro data format module of the FasterXML Jackson suite, published from the jackson-dataformats-binary repository. It lets Jackson read and write Avro-encoded binary data through the standard Jackson streaming and data-binding APIs.

A denial of service vulnerability (CVE-2026-104015) has been identified in the Avro parsers of jackson-dataformat-avro, which allows attackers to force very large heap allocations with a small malicious Avro payload. Repeated or concurrent requests carrying such payloads can exhaust the heap of the parsing application.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed.

This issue affects multiple versions of Jackson.

Details

Module Info

• Product: Jackson
• Affected packages: com.fasterxml.jackson.dataformat:jackson-dataformat-avro
• Affected versions: <2.18.12, >=2.19.0 <2.21.8, >=2.22.0 <2.22.4
• GitHub repository: https://github.com/FasterXML/jackson-dataformats-binary
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-avro
• Package manager: Maven
• Fixed in:
  • OSS Jackson 2.18.12, 2.21.8, 2.22.4
  • NES for Jackson v2.13.13, v2.14.10, v2.15.11

Vulnerability Info

This High-severity vulnerability is found in the com.fasterxml.jackson.dataformat:jackson-dataformat-avro package in multiple versions of Jackson. In Avro binary encoding, a bytes value is written as a variable-length integer giving its length, followed by that many bytes of content. The default parser, JacksonAvroParserImpl, reads that length straight from the input and allocates a byte[] of the declared size before it checks whether any of the content is actually present:

@Override
public JsonToken decodeBytes() throws IOException {
    int len = decodeInt();
    if (len <= 0) {
        if (len < 0) {
            _reportError("Invalid length indicator for Bytes: "+len);
        }
        _binaryValue = NO_BYTES;
    } else {
        byte[] b = new byte[len];
        // this is simple raw read, safe to use:
        _read(b, 0, len);
        _binaryValue = b;
    }
    return JsonToken.VALUE_EMBEDDED_OBJECT;
}

The alternative ApacheAvroParserImpl does the same in its decodeBytes method, allocating new byte[len] from the length returned by _decoder.readInt(). In both parsers, decodeFixed likewise allocates the full declared size of a fixed value with new byte[size] before reading any content. By default, neither parser puts an upper bound on a bytes length: JacksonAvroParserImpl rejects only negative values and ApacheAvroParserImpl treats them as empty, so a length near Integer.MAX_VALUE is accepted.

A payload of only a few bytes can therefore declare a bytes value of up to about 2 GB. The parser allocates the full buffer at once and only then reaches end-of-input. Every such document makes the JVM reserve a huge array, which leads to OutOfMemoryError or heavy garbage-collection pressure. Any application that parses untrusted Avro data with AvroMapper, AvroFactory or AvroParser against a schema that contains a bytes field is exposed.

Mitigation

Only recent versions of Jackson are community-supported. Release lines the project has closed are End-of-Life and will not receive community updates addressing this issue. Branch status is published on the project's own Jackson Releases page.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-dataformat-avro to a currently supported release containing the fix, such as 2.18.12 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.