Skip to content
Fencer Vulns
no cvss —

CVE-2026-106554 json

jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

published 2026-11-04 4 d ago modified 2026-11-04 4 d ago also EUVD-2026-116970

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits
0
none known

Summary

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).

PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.

Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).

CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.

PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.

Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.

Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).

Patch / fix

  • FasterXML jackson-dataformat-cbor 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4
  • jackson-dataformats-binary Debian 14 2.22.4-1

debian advisories DEBIAN-CVE-2026-106554

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-106554 updated cvss 7.5

com.fasterxml.jackson.dataformat/jackson-dataformat-cbor: jackson-dataformat-cbor: Denial of Service via unbounded CBOR tags

  • Red Hat OpenShift Developer Tools and Services ocp-tools-4/jenkins-rhel8, ocp-tools-4/jenkins-rhel9, jenkins 2.516.3.1758206866-3.el9, jenkins-2-plugins 4.19.1758207171-1.el9 Red Hat build of Apache Camel for Spring Boot 4 jackson-dataformat-cbor 2.21.4.redhat-00002 Red Hat Build of Keycloak rhbk/keycloak-rhel9, jackson-dataformat-cbor 2.21.4.redhat-00002 Red Hat Enterprise Linux 8 jackson-jaxrs-providers, jackson-jaxrs-json-provider, jackson-jaxrs-providers-parent, jackson-jaxrs-providers-javadoc, jackson-jaxrs-providers-datatypes Red Hat Enterprise Linux 9 jackson-jaxrs-providers, pki-jackson-jaxrs-providers, pki-jackson-jaxrs-json-provider Red Hat Fuse 7 jackson-dataformat-cbor 2.21.4.redhat-00002
    +3 more products
    Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat Satellite 6 openvox-server 8.17.0-1.el9sat Red Hat Single Sign-On 7 rh-sso7-keycloak, rh-sso7-keycloak-server, jackson-dataformat-cbor 2.21.4.redhat-00002
    under investigation

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • FasterXML jackson-dataformat-cbor

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.