CVE-2026-110747

{
  "etk_id": "ETK-2026-2817",
  "cve_id": "CVE-2026-110747",
  "display_id": "CVE-2026-110747",
  "ghsa_id": "GHSA-fv7v-rrmh-4qcv",
  "euvd_id": "EUVD-2026-111531",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Integer-overflow denial of service in jackson-dataformat-protobuf",
  "summary": "Affected jackson-dataformat-protobuf versions can mishandle a length value while parsing protobuf map string keys. An attacker able to submit protobuf data to an application may trigger excessive memory allocation and potentially terminate the JVM. Configured StreamReadConstraints do not prevent this condition.",
  "mitigation": "Upgrade com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf to 2.21.8 or 2.22.4, or tools.jackson.dataformat:jackson-dataformat-protobuf to 3.1.8 or 3.2.4. Restrict untrusted access to protobuf parsing endpoints until the upgrade is complete.",
  "vendor": "FasterXML",
  "product": "jackson-dataformat-protobuf",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.21.6, <= 2.21.7"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.21.8"
      ],
      "package_name": "com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf",
      "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.22.0, <= 2.22.3"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "2.22.4"
      ],
      "package_name": "com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf",
      "purl": "pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-protobuf"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=3.1.6, <=3.1.7"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "3.1.8"
      ],
      "package_name": "tools.jackson.dataformat:jackson-dataformat-protobuf",
      "purl": "pkg:maven/tools.jackson.dataformat/jackson-dataformat-protobuf"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=3.2.2, <=3.2.3"
      ],
      "ecosystem": "maven",
      "fixed_versions": [
        "3.2.4"
      ],
      "package_name": "tools.jackson.dataformat:jackson-dataformat-protobuf",
      "purl": "pkg:maven/tools.jackson.dataformat/jackson-dataformat-protobuf"
    }
  ],
  "cwes": [
    190
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 16.6130285,
  "t0_at": "2026-10-28T00:02:32.462000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-28T00:02:32.462000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T00:02:32.462000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110747"
    }
  }
}