{"metadata": {"vulnerability": "CVE-2026-106554", "count": 10, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 5}}, "data": [{"timestamp": "2026-10-06T20:27:12.839Z", "date_only": false, "value": "2026-10-06T20:27:12.839Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-106554", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-22T21:30:00Z", "date_only": false, "value": "2026-10-22T21:30:00.000Z", "kind": "other", "label": "Timeline", "source": "cvelistv5 / HeroDevs", "record": "CVE-2026-106554", "field": "containers.cna.timeline.0.time", "text": "GHSA-cjg7-h3pr-p927 published in FasterXML/jackson-dataformats-binary"}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-106554", "record": "UBUNTU-CVE-2026-106554", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-106554", "record": "UBUNTU-CVE-2026-106554", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-04T16:14:05.664Z", "date_only": false, "value": "2026-11-04T16:14:05.664Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-106554", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-04T16:14:05.664Z", "date_only": false, "value": "2026-11-04T16:14:05.664Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-106554", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-04T16:14:05.664Z", "date_only": false, "value": "2026-11-04T16:14:05.664Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / HeroDevs", "record": "CVE-2026-106554", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-04T16:17:32.640Z", "date_only": false, "value": "2026-11-04T16:17:32.640", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-106554", "record": "FKIE_CVE-2026-106554", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-04T16:17:32.640Z", "date_only": false, "value": "2026-11-04T16:17:32.640", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-106554", "record": "FKIE_CVE-2026-106554", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-11-04T16:19:58.027Z", "date_only": false, "value": "2026-11-04T16:19:58.027180Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117559079559120410", "record": "CVE-2026-106554", "field": "creation_timestamp", "uuid": "beef046a-d5c1-4005-b26c-cea22d2589a5", "content": "CVE-2026-106554 jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC) One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).\nhttps://www.cve.org/CVERecord?id=CVE-2026-106554https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927#FasterXML #jackson-dataformat-cbor#CVE_2026_106554#bot", "url": "https://infosec.exchange/users/cve/statuses/117559079559120410"}], "metrics": {"as_of": "2026-11-07T05:40:20.491Z", "anchors": {"origin": {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-106554", "record": "UBUNTU-CVE-2026-106554", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-106554", "record": "UBUNTU-CVE-2026-106554", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 279620.491469, "hours": 77.67235874138889, "days": 3.2363482808912036, "min_seconds": 193220.491469, "max_seconds": 279620.491469, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-11-04T00:00:00Z", "date_only": false, "value": "2026-11-04T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-106554", "record": "UBUNTU-CVE-2026-106554", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, "end": {"timestamp": "2026-11-07T05:40:20.491Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}