CVE-2026-104016

Overview

jackson-dataformat-protobuf is the Protobuf backend of the FasterXML Jackson suite. It provides the streaming parser and generator that let Jackson read and write Google Protocol Buffers wire format through the same databind APIs used for JSON, and it sits alongside the other binary dataformat modules in the jackson-dataformats-binary repository.

A Denial of Service (DoS) vulnerability (CVE-2026-104016) has been identified in the Protobuf streaming parser of Jackson, which allows attackers to supply a length prefix that overflows signed 32-bit arithmetic in the parser's bounds check and reach an unbounded character-buffer allocation, so that a payload of a few dozen bytes drives an allocation near the JVM's maximum array size and exhausts available memory.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects the Protobuf parsing path of Jackson, reached whenever an application decodes Protobuf content containing length-prefixed string fields.

Details

Module Info

• Product: Jackson
• Affected packages: com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf, tools.jackson.dataformat:jackson-dataformat-protobuf
• Affected versions: com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf: >=2.0.0 <2.18.12, >=2.19.0 <2.21.8, >=2.22.0 <2.22.4; tools.jackson.dataformat:jackson-dataformat-protobuf: >=3.0.0 <3.1.8, >=3.2.0 <3.2.4
• GitHub repository: https://github.com/FasterXML/jackson-dataformats-binary
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf
• Package manager: Maven
• Fixed in:
  • OSS Jackson 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4
  • NES for Jackson v2.13.13, v2.14.10, v2.15.11

Vulnerability Info

This High-severity vulnerability is found in the jackson-dataformat-protobuf package in multiple versions of Jackson. ProtobufParser decodes a length-prefixed string field by reading a varint length and then deciding whether the whole value is already buffered. That decision is made with signed 32-bit addition:

if ((_inputPtr + len) <= _inputEnd) {
    return _finishShortText(len);
}

Both _inputPtr and len are int. When a varint decodes to a len near Integer.MAX_VALUE, _inputPtr + len wraps to a negative value, so the comparison against _inputEnd succeeds and the parser takes the fast path with the attacker's length intact. _finishShortText(int len) then sizes its working buffer directly from that value:

outBuf = _textBuffer.expandCurrentSegment(len);

TextBuffer.expandCurrentSegment performs an Arrays.copyOf to the requested size with no upper bound, so the JVM is asked for an array near Integer.MAX_VALUE elements and raises OutOfMemoryError: Requested array size exceeds VM limit. The same unguarded pattern appears at every call site that reaches _finishShortText, including the paths behind nextTextValue, getText, getValueAsString and getText(Writer).

The heap ceiling does not protect the caller: the JVM rejects an array larger than Integer.MAX_VALUE - 8 before it consults available heap, so the failure occurs regardless of -Xmx. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path either, because the allocation happens before either limit is consulted and the payload itself is far below any document-length cap. The resulting OutOfMemoryError is an Error rather than a JacksonException, so it escapes the parser's declared contract and propagates into the calling thread.

Steps to Reproduce

1. Define a Protobuf schema containing a repeated string field and build a default ProtobufMapper.

2. Send a document whose field 7 tag is followed by a varint that decodes to 0x7fffffff, with no payload bytes.

3. Read the document; the parser allocates on the attacker's declared length and raises OutOfMemoryError.

ProtobufMapper m = new ProtobufMapper();
ProtobufSchema s = ProtobufSchemaLoader.std.parse(
    "message R { optional string s=1; repeated string sarr=7; }");

// tag 0x3a (field 7, wire type 2) + varint 0x7fffffff, then no body
byte[] payload = { (byte) 0x3a, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0xff, (byte) 0x07 };

m.readerFor(Map.class).with(s).readValue(payload);
// java.lang.OutOfMemoryError: Requested array size exceeds VM limit

Mitigation

Only recent versions of Jackson are community-supported. Release lines the project has closed are End-of-Life and will not receive community updates addressing this issue. Branch status is published on the project's own Jackson Releases page.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-dataformat-protobuf to a currently supported release containing the fix, such as 2.18.12 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.