CVE-2026-104017

Overview

jackson-dataformat-protobuf is the Protobuf backend of the FasterXML Jackson suite. It provides the streaming parser and generator that let Jackson read and write Google Protocol Buffers wire format through the same databind APIs used for JSON, and it sits alongside the other binary dataformat modules in the jackson-dataformats-binary repository.

A Denial of Service (DoS) vulnerability (CVE-2026-104017) has been identified in the Protobuf streaming parser of Jackson, which allows attackers to declare an arbitrary length for a bytes field and have the parser allocate a byte array of that size before any of the body is read, so that a message of a few bytes forces an allocation of hundreds of megabytes or more and exhausts available memory under light concurrency.

Per OWASP: The Denial of Service (DoS) attack is focused on making a resource (site, application, server) unavailable for the purpose it was designed. There are many ways to make a service unavailable for legitimate users by manipulating network packets, programming, logical, or resources handling vulnerabilities, among others. If a service receives a very large number of requests, it may cease to be available to legitimate users. In the same way, a service may stop if a programming vulnerability is exploited, or the way the service handles resources it uses.

This issue affects the Protobuf parsing path of Jackson, reached whenever an application decodes Protobuf content containing a length-delimited bytes field.

Details

Module Info

• Product: Jackson
• Affected packages: com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf
• Affected versions: com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf: >=2.0.0 <2.18.12
• GitHub repository: https://github.com/FasterXML/jackson-dataformats-binary
• Published packages: https://central.sonatype.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf
• Package manager: Maven
• Fixed in:
  • OSS Jackson 2.18.12
  • NES for Jackson v2.13.13, v2.14.10, v2.15.11

Vulnerability Info

This High-severity vulnerability is found in the jackson-dataformat-protobuf package in multiple versions of Jackson. For a length-delimited bytes field, ProtobufParser._decodeLength() returns a fully attacker-controlled positive int up to Integer.MAX_VALUE and stores it in _decodedLength with no bound against the remaining input. The _currentEndOffset checks that constrain embedded message fields do not apply to bytes fields. _finishBytes then allocates from that declared length before reading any of the body:

protected byte[] _finishBytes(int len) throws IOException
{
    byte[] b = new byte[len];
    if (_inputPtr >= _inputEnd) {
        loadMoreGuaranteed();
    }
    int ptr = 0;
    while (true) {
        int toAdd = Math.min(len, _inputEnd - _inputPtr);
        System.arraycopy(_inputBuffer, _inputPtr, b, ptr, toAdd);
        ...
    }
}

The array is sized and committed on the first line, so a truncated or entirely absent body is only discovered afterwards. A six-byte message consisting of the tag 0x0A followed by the varint for 2147483647 therefore drives a request for a two-gigabyte array; lengths in the few-hundred-megabyte range exhaust a typical heap reliably under a small number of concurrent requests.

This is the same class of flaw as the CBOR parser's eager binary allocation, which was addressed in that backend with a chunked read guarded by a maximum non-chunked binary length. The Protobuf parser never received the equivalent guard. The resulting OutOfMemoryError is an Error rather than a JacksonException, so it escapes the parser's declared contract and crashes the request thread.

Steps to Reproduce

1. Define a Protobuf schema with a single bytes field and build a default ProtobufMapper.

2. Send the six wire bytes below: the field tag, then a varint declaring 2147483647 bytes, then no payload.

3. Read the document; the parser allocates the declared length before discovering the body is absent.

ProtobufMapper m = new ProtobufMapper();
ProtobufSchema s = ProtobufSchemaLoader.std.parse("message Foo { optional bytes data = 1; }");

// tag 0x0A (field 1, wire type 2) + varint 0x7fffffff, then no body
byte[] payload = { (byte) 0x0A, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0xFF, (byte) 0x07 };

m.readerFor(Foo.class).with(s).readValue(payload);
// java.lang.OutOfMemoryError

Mitigation

Only recent versions of Jackson are community-supported. Release lines the project has closed are End-of-Life and will not receive community updates addressing this issue. Branch status is published on the project's own Jackson Releases page.

Users of the affected components should apply one of the following mitigations:

• Upgrade jackson-dataformat-protobuf to a currently supported release containing the fix, such as 2.18.12 or later.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• apvxlab from AppViewX (finder)