jackson-dataformat-protobuf vulnerabilities

2 known vulnerabilities in jackson-dataformat-protobuf from FasterXML. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  jackson-dataformat-protobuf: Integer Overflow or Wraparound

  CVE-2026-110747Oct 28, 2026FasterXML

  ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a n

• 7.5 High severity

  jackson-dataformat-protobuf: Integer Overflow or Wraparound

  CVE-2026-104016Oct 28, 2026FasterXML

  ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding