Hoch 7.5Linux-Server
CVE-2026-106554
com.fasterxml.jackson.dataformat/jackson-dataformat-cbor: jackson-dataformat-cbor: Denial of Service via unbounded CBOR tags
com.fasterxml.jackson.dataformat/jackson-dataformat-cbor
One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File…
4. Nov 2026
Original bei Red Hat öffnen