Vulnerability-Lookup

CVE-2026-106554 (GCVE-0-2026-106554)

Vulnerability from cvelistv5 – Published: 2026-11-04 16:14 – Updated: 2026-11-04 16:14 X_Open Source

Title

jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

Summary

One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList). CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags. PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit. Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool. Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).

Severity

No CVSS data available.

CWE

CWE-407 - Inefficient Algorithmic Complexity

Assigner

HeroDevs CNA under the mitre root

CNA scorecard B 82/100 over 18 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/FasterXML/jackson-dataformats-…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version	CPE status
FasterXML	jackson-dataformat-cbor	Affected: 2.15.0 , < 2.18.12 (maven) Unaffected: 2.18.12 (maven) Affected: 2.19.0 , < 2.21.8 (maven) Unaffected: 2.21.8 (maven) Affected: 2.22.0 , < 2.22.4 (maven) Unaffected: 2.22.4 (maven)	guessed
FasterXML	jackson-dataformat-cbor	Affected: 3.0.0 , < 3.1.8 (maven) Unaffected: 3.1.8 (maven) Affected: 3.2.0 , < 3.2.4 (maven) Unaffected: 3.2.4 (maven)	guessed

Credits

apvxlab (AppViewX security research) v0xyc0n (www.jpac.at)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "2.18.12",
              "status": "affected",
              "version": "2.15.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.18.12",
              "versionType": "maven"
            },
            {
              "lessThan": "2.21.8",
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.21.8",
              "versionType": "maven"
            },
            {
              "lessThan": "2.22.4",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.22.4",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "tools.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "3.1.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.1.8",
              "versionType": "maven"
            },
            {
              "lessThan": "3.2.4",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.2.4",
              "versionType": "maven"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "apvxlab (AppViewX security research)"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "v0xyc0n (www.jpac.at)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOne CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\u003c/p\u003e\u003cp\u003ePoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\u003c/p\u003e\u003cp\u003eQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u0026gt; TagList).\u003c/p\u003e\u003cp\u003eCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\u003c/p\u003e\u003cp\u003ePoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\u003c/p\u003e\u003cp\u003eImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\u003c/p\u003e\u003cp\u003eFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).\u003c/p\u003e"
            }
          ],
          "value": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."
        }
      ],
      "metrics": [
        {
          "format": "other",
          "other": {
            "content": {
              "text": "MEDIUM"
            },
            "type": "severity"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-407",
              "description": "CWE-407 Inefficient Algorithmic Complexity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T16:14:05.664Z",
        "orgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "shortName": "HeroDevs"
      },
      "references": [
        {
          "name": "GHSA-cjg7-h3pr-p927",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"
        }
      ],
      "source": {
        "advisory": "GHSA-cjg7-h3pr-p927",
        "discovery": "EXTERNAL"
      },
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-22T21:30:00.000Z",
          "value": "GHSA-cjg7-h3pr-p927 published in FasterXML/jackson-dataformats-binary"
        }
      ],
      "title": "jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36c7be3b-2937-45df-85ea-ca7133ea542c",
    "assignerShortName": "HeroDevs",
    "cveId": "CVE-2026-106554",
    "datePublished": "2026-11-04T16:14:05.664Z",
    "dateReserved": "2026-10-06T20:27:12.839Z",
    "dateUpdated": "2026-11-04T16:14:05.664Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-106554",
      "date": "2026-11-06",
      "epss": "0.00177",
      "percentile": "0.07357"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor",
                "product": "jackson-dataformat-cbor",
                "programFiles": [
                  "cbor/src/main/java/.../cbor/CBORParser.java"
                ],
                "programRoutines": [
                  {
                    "name": "CBORParser (tag handling -\u003e TagList)"
                  }
                ],
                "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
                "vendor": "FasterXML",
                "versions": [
                  {
                    "lessThan": "2.18.12",
                    "status": "affected",
                    "version": "2.15.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "2.18.12",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "2.21.8",
                    "status": "affected",
                    "version": "2.19.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "2.21.8",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "2.22.4",
                    "status": "affected",
                    "version": "2.22.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "2.22.4",
                    "versionType": "maven"
                  }
                ]
              },
              {
                "collectionURL": "https://repo.maven.apache.org/maven2",
                "defaultStatus": "unaffected",
                "packageName": "tools.jackson.dataformat:jackson-dataformat-cbor",
                "product": "jackson-dataformat-cbor",
                "programFiles": [
                  "cbor/src/main/java/.../cbor/CBORParser.java"
                ],
                "programRoutines": [
                  {
                    "name": "CBORParser (tag handling -\u003e TagList)"
                  }
                ],
                "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
                "vendor": "FasterXML",
                "versions": [
                  {
                    "lessThan": "3.1.8",
                    "status": "affected",
                    "version": "3.0.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "3.1.8",
                    "versionType": "maven"
                  },
                  {
                    "lessThan": "3.2.4",
                    "status": "affected",
                    "version": "3.2.0",
                    "versionType": "maven"
                  },
                  {
                    "status": "unaffected",
                    "version": "3.2.4",
                    "versionType": "maven"
                  }
                ]
              }
            ],
            "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."
          }
        ],
        "id": "CVE-2026-106554",
        "lastModified": "2026-11-04T16:17:32.640",
        "metrics": {},
        "published": "2026-11-04T16:17:32.640",
        "references": [
          {
            "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
            "url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"
          }
        ],
        "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-407"
              }
            ],
            "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-11-06T02:27:26+00:00",
      "cve": "CVE-2026-106554",
      "id": "CVE-2026-106554",
      "initial_release_date": "2026-11-04T16:14:05.664000+00:00",
      "product_status:under_investigation": "23",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "com.fasterxml.jackson.dataformat/jackson-dataformat-cbor: jackson-dataformat-cbor: Denial of Service via unbounded CBOR tags",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-106554.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-106554

Vulnerability from fkie_nvd - Published: 2026-11-04 16:17 - Updated: 2026-11-04 16:17

Severity

Summary

References

	URL	Tags
	36c7be3b-2937-45df-85ea-ca7133ea542c	https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "com.fasterxml.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "2.18.12",
              "status": "affected",
              "version": "2.15.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.18.12",
              "versionType": "maven"
            },
            {
              "lessThan": "2.21.8",
              "status": "affected",
              "version": "2.19.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.21.8",
              "versionType": "maven"
            },
            {
              "lessThan": "2.22.4",
              "status": "affected",
              "version": "2.22.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "2.22.4",
              "versionType": "maven"
            }
          ]
        },
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "tools.jackson.dataformat:jackson-dataformat-cbor",
          "product": "jackson-dataformat-cbor",
          "programFiles": [
            "cbor/src/main/java/.../cbor/CBORParser.java"
          ],
          "programRoutines": [
            {
              "name": "CBORParser (tag handling -\u003e TagList)"
            }
          ],
          "repo": "https://github.com/FasterXML/jackson-dataformats-binary",
          "vendor": "FasterXML",
          "versions": [
            {
              "lessThan": "3.1.8",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.1.8",
              "versionType": "maven"
            },
            {
              "lessThan": "3.2.4",
              "status": "affected",
              "version": "3.2.0",
              "versionType": "maven"
            },
            {
              "status": "unaffected",
              "version": "3.2.4",
              "versionType": "maven"
            }
          ]
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).\n\n\n\nPoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.\n\n\n\nQuadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList).\n\n\n\nCBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.\n\n\n\nPoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.\n\n\n\nImpact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.\n\n\n\nFix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style)."
    }
  ],
  "id": "CVE-2026-106554",
  "lastModified": "2026-11-04T16:17:32.640",
  "metrics": {},
  "published": "2026-11-04T16:17:32.640",
  "references": [
    {
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "url": "https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-cjg7-h3pr-p927"
    }
  ],
  "sourceIdentifier": "36c7be3b-2937-45df-85ea-ca7133ea542c",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-407"
        }
      ],
      "source": "36c7be3b-2937-45df-85ea-ca7133ea542c",
      "type": "Secondary"
    }
  ]
}

UBUNTU-CVE-2026-106554 (CVE-2026-106554)

Vulnerability from osv_ubuntu – Published: 2026-11-04 00:00 – Updated: 2026-11-04 00:00 – Source website

Details

Severity

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-106554	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-106554	REPORT
	github.com/fasterxml/jackson-dataformats-binary	REPORT
	repo.maven.apache.org/maven2	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.4.3-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.4.3-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.4.3-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-3?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-1",
        "2.7.8-2",
        "2.7.8-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-3",
        "2.7.8-4",
        "2.7.8-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.10",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5.1?arch=source\u0026distro=stonking"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-5.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libjackson2-dataformat-cbor",
            "binary_version": "2.7.8-5.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jackson-dataformat-cbor",
        "purl": "pkg:deb/ubuntu/jackson-dataformat-cbor@2.7.8-5.1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.7.8-5.1"
      ]
    }
  ],
  "aliases": [],
  "details": "One CBOR-parsing issue in jackson-dataformats-binary\u0027s CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo. Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -\u003e TagList). CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags. PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit. Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool. Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).",
  "id": "UBUNTU-CVE-2026-106554",
  "modified": "2026-11-04T00:00:00Z",
  "published": "2026-11-04T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-106554"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-106554"
    },
    {
      "type": "REPORT",
      "url": "github.com/fasterxml/jackson-dataformats-binary"
    },
    {
      "type": "REPORT",
      "url": "repo.maven.apache.org/maven2"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-106554"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-106554 (GCVE-0-2026-106554)

FKIE_CVE-2026-106554

UBUNTU-CVE-2026-106554 (CVE-2026-106554)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour