jackson-dataformats-binary vulnerabilities

2 known vulnerabilities in jackson-dataformats-binary from FasterXML. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  jackson-dataformats-binary: Uncontrolled Resource Consumption

  CVE-2026-68496Oct 1, 2026FasterXML

  The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. SmileParser._handleLongFieldName() grows its

• 7.5 High severity

  jackson-dataformats-binary: Uncontrolled Resource Consumption

  CVE-2026-68495Oct 1, 2026FasterXML

  The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLongerName() decodes a defi