{"metadata": {"vulnerability": "CVE-2026-104016", "count": 24, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 15}}, "data": [{"timestamp": "2026-10-01T16:52:07.587Z", "date_only": false, "value": "2026-10-01T16:52:07.587Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104016", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-20T22:44:36Z", "date_only": false, "value": "2026-10-20T22:44:36+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.2.release_date"}, {"timestamp": "2026-10-20T22:46:00Z", "date_only": false, "value": "2026-10-20T22:46:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / HeroDevs", "record": "CVE-2026-104016", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-22T00:00:00Z", "date_only": false, "value": "2026-10-22T00:00:00+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.2.discovery_date"}, {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T23:52:20.141Z", "date_only": false, "value": "2026-10-27T23:52:20.141Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104016", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T23:52:20.141Z", "date_only": false, "value": "2026-10-27T23:52:20.141000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-27T23:52:20.141Z", "date_only": false, "value": "2026-10-27T23:52:20.141Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104016", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-27T23:52:20.141Z", "date_only": false, "value": "2026-10-27T23:52:20.141Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / HeroDevs", "record": "CVE-2026-104016", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-27T23:58:43.838Z", "date_only": false, "value": "2026-10-27T23:58:43.838015Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117515585016834235", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "8f5724f7-7780-43fb-9943-4193f4c1adee", "content": "CVE-2026-104016 jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and _finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit.\nThe JVM refuses arrays larger than Integer.MAX_VALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured.\nA February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104016https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-c2rq-mcfv-jw29#FasterXML #jackson-dataformat-protobuf#CVE_2026_104016#bot", "url": "https://infosec.exchange/users/cve/statuses/117515585016834235"}, {"timestamp": "2026-10-28T00:01:07.786Z", "date_only": false, "value": "2026-10-28T00:01:07.786524+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T00:02:32.462Z", "date_only": false, "value": "2026-10-28T00:02:32.462000+00:00", "kind": "other", "label": "Release date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.1.release_date"}, {"timestamp": "2026-10-28T00:17:10.530Z", "date_only": false, "value": "2026-10-28T00:17:10.530", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104016", "record": "FKIE_CVE-2026-104016", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T00:43:47.079Z", "date_only": false, "value": "2026-10-28T00:43:47.079925Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117515762168803428", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "d759f164-29cf-4bfc-89dd-4aace07ba026", "content": "CVE-2026-110747 jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.\nAn 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.\nThis is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.\nhttps://www.cve.org/CVERecord?id=CVE-2026-110747https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-fv7v-rrmh-4qcv#FasterXML #jackson-dataformat-protobuf#CVE_2026_110747#bot", "url": "https://infosec.exchange/users/cve/statuses/117515762168803428"}, {"timestamp": "2026-10-28T00:52:13.626Z", "date_only": false, "value": "2026-10-28T00:52:13.626351+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.1.discovery_date"}, {"timestamp": "2026-10-28T01:52:58.894Z", "date_only": false, "value": "2026-10-28T01:52:58.894033Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/aoctm4yvfywsx", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "6dc4420f-400e-444f-a86a-a7a583df336f", "content": "CVE-2026-104016 - jackson-dataformat-protobuf: signed integer overflow in string-length paths allows unbounded array allocation and OutOfMemoryError\nCVE ID : CVE-2026-104016\n \n Published : Oct. 28, 2026, 12:17 a.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : ProtobufParser parses...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/aoctm4yvfywsx"}, {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "f144ecf3-c98c-43e7-b111-ec0c6bc3bb3e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "9cf80dab-283e-408b-83b1-47fabd058f2b"}, {"timestamp": "2026-10-28T15:24:56.033Z", "date_only": false, "value": "2026-10-28T15:24:56.033", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104016", "record": "FKIE_CVE-2026-104016", "field": "lastModified"}, {"timestamp": "2026-10-30T18:42:35Z", "date_only": false, "value": "2026-10-30T18:42:35+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-30T18:42:35Z", "date_only": false, "value": "2026-10-30T18:42:35+00:00", "kind": "other", "label": "Document generated", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-30T18:42:35Z", "date_only": false, "value": "2026-10-30T18:42:35+00:00", "kind": "other", "label": "Updated", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.current_release_date"}], "metrics": {"as_of": "2026-10-30T22:19:43.666Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:01:07.786Z", "date_only": false, "value": "2026-10-28T00:01:07.786524+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "discovery": {"timestamp": "2026-10-28T00:01:07.786Z", "date_only": false, "value": "2026-10-28T00:01:07.786524+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "f144ecf3-c98c-43e7-b111-ec0c6bc3bb3e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 18394.0, "hours": 5.109444444444445, "days": 0.2128935185185185, "min_seconds": 18394.0, "max_seconds": 18394.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "f144ecf3-c98c-43e7-b111-ec0c6bc3bb3e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": true, "seconds": -7650.786, "hours": -2.125218333333333, "days": -0.08855076388888888, "min_seconds": -7650.786, "max_seconds": -7650.786, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-28T00:01:07.786Z", "date_only": false, "value": "2026-10-28T00:01:07.786524+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "disclosure_to_patch": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "milestone", "label": "Published", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 0.0, "hours": 0.0, "days": 0.0, "min_seconds": 0.0, "max_seconds": 0.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-28T00:01:07.786Z", "date_only": false, "value": "2026-10-28T00:01:07.786524+00:00", "kind": "other", "label": "Discovery date", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": -18394.0, "hours": -5.109444444444445, "days": -0.2128935185185185, "min_seconds": -18394.0, "max_seconds": -18394.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": true, "start": {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104016", "field": "creation_timestamp", "uuid": "f144ecf3-c98c-43e7-b111-ec0c6bc3bb3e", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-10-27T21:53:37Z", "date_only": false, "value": "2026-10-27T21:53:37+00:00", "kind": "other", "label": "Vendor fix", "source": "csaf_redhat \u00b7 RHSA-2026:91304", "record": "RHSA-2026:91304", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}}}