CVE-2026-68495
Description
A flaw was found in jackson-dataformat-cbor. The parser fails to enforce maximum property name length limits when decoding Concise Binary Object Representation (CBOR) documents. A remote attacker can exploit this vulnerability by submitting a crafted CBOR document containing an excessively long property name. Processing this input causes unbounded memory allocation, leading to heap exhaustion and a Denial of Service (DoS).
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can exhaust application heap memory and crash the service by sending oversized object field names without requiring prior privileges. Red Hat products are only vulnerable if they host endpoints that accept and deserialize CBOR-encoded payloads using Jackson binary dataformat modules. Applications utilizing Jackson strictly for standard JSON serialization or those that do not expose CBOR processing to untrusted network traffic are not susceptible to this denial-of-service condition.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
