{"metadata": {"vulnerability": "CVE-2026-104895", "count": 11, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 4}}, "data": [{"timestamp": "2026-10-02T15:02:48.774Z", "date_only": false, "value": "2026-10-02T15:02:48.774Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-104895", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-20T22:47:00Z", "date_only": false, "value": "2026-10-20T22:47:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / HeroDevs", "record": "CVE-2026-104895", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104895", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-104895", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / HeroDevs", "record": "CVE-2026-104895", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T00:03:44.511Z", "date_only": false, "value": "2026-10-28T00:03:44.511156Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117515604717680215", "record": "CVE-2026-104895", "field": "creation_timestamp", "uuid": "a3fa253f-0405-46c9-9ead-bfa31c51984c", "content": "CVE-2026-104895 jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.\nA Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.\nThis is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.\nhttps://www.cve.org/CVERecord?id=CVE-2026-104895https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-h3c2-2m49-r49w#FasterXML #jackson-dataformat-smile#CVE_2026_104895#bot", "url": "https://infosec.exchange/users/cve/statuses/117515604717680215"}, {"timestamp": "2026-10-28T00:17:11.357Z", "date_only": false, "value": "2026-10-28T00:17:11.357", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104895", "record": "FKIE_CVE-2026-104895", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-28T02:00:58.852Z", "date_only": false, "value": "2026-10-28T02:00:58.852126Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/buwky4b5t4kfn", "record": "CVE-2026-104895", "field": "creation_timestamp", "uuid": "65660367-d1b8-4cd8-ac33-93c21d86b6f5", "content": "CVE-2026-104895 - jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service\nCVE ID : CVE-2026-104895\n \n Published : Oct. 28, 2026, 12:17 a.m. | 1\u00a0hour, 8\u00a0minutes ago\n \n Description : The asynchronou...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/buwky4b5t4kfn"}, {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104895", "field": "creation_timestamp", "uuid": "42b8034a-5502-43dc-b120-c301b26ccc82", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104895", "field": "creation_timestamp", "uuid": "51bc71fb-ef7e-4f12-9081-c3c149b6a531"}, {"timestamp": "2026-10-28T15:24:56.033Z", "date_only": false, "value": "2026-10-28T15:24:56.033", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-104895", "record": "FKIE_CVE-2026-104895", "field": "lastModified"}], "metrics": {"as_of": "2026-11-01T10:40:04.201Z", "anchors": {"origin": {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104895", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104895", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104895", "field": "creation_timestamp", "uuid": "42b8034a-5502-43dc-b120-c301b26ccc82", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": true, "seconds": 10706.504, "hours": 2.9740288888888893, "days": 0.12391787037037039, "min_seconds": 10706.504, "max_seconds": 10706.504, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104895", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104895", "field": "creation_timestamp", "uuid": "42b8034a-5502-43dc-b120-c301b26ccc82", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 383899.705393, "hours": 106.6388070536111, "days": 4.443283627233796, "min_seconds": 383899.705393, "max_seconds": 383899.705393, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T00:01:44.496Z", "date_only": false, "value": "2026-10-28T00:01:44.496Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-104895", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T10:40:04.201Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": true, "seconds": 373193.201393, "hours": 103.66477816472224, "days": 4.3193657568634265, "min_seconds": 373193.201393, "max_seconds": 373193.201393, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-28T03:00:11Z", "date_only": false, "value": "2026-10-28T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/0hF2E9aVfGvplPzTbP1TR7HraeqVaMSQJzVRlRVjLuuSVLA", "record": "CVE-2026-104895", "field": "creation_timestamp", "uuid": "42b8034a-5502-43dc-b120-c301b26ccc82", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-01T10:40:04.201Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}