Description
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.



A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.



This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
Published: 2026-10-28
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

The asynchronous Smile parser in jackson-dataformat-smile allocates a byte array for raw binary data based on a length prefix supplied by untrusted input. This prefix, parsed as an unsigned variable-length integer, is used to allocate memory without an upper bound or overflow protection. An attacker can craft a VInt that requests the allocation of billions of bytes or a negative length, causing the parser to throw an OutOfMemoryError or a NegativeArraySizeException. Both outcomes crash the processing thread or request, resulting in a denial of service. This resource exhaustion flaw is identified as CWE‑789.

Affected Systems

All deployments of FasterXML's jackson-dataformat-smile that include the unpatched NonBlockingByteArrayParser are affected. No specific version range is provided in the advisory, so any installation lacking the LONGEST_NON_CHUNKED_BINARY guard is vulnerable.

Risk and Exploitability

The CVSS score of 7.5 reflects high severity for denial of service. Though the EPSS score is not available, the vulnerability can be exploited by any party able to submit Smile data to a vulnerable endpoint; no special privileges or user interaction are required. The flaw is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time.

Generated by OpenCVE AI on October 28, 2026 at 01:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade jackson-dataformat-smile to the patched release that implements the LONGEST_NON_CHUNKED_BINARY guard for raw binary payloads.
  • If an immediate upgrade is infeasible, configure the application to reject or cap the size of raw binary inputs and disable the async Smile parser for untrusted data.
  • Continuously monitor application logs for OutOfMemoryError or NegativeArraySizeException incidents and isolate affected services until a patch is deployed.

Generated by OpenCVE AI on October 28, 2026 at 01:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
Description The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
Title jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
Weaknesses CWE-789
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: HeroDevs

Published:

Updated: 2026-10-28T00:01:44.496Z

Reserved: 2026-10-02T15:02:48.774Z

Link: CVE-2026-104895

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T00:17:11.357

Modified: 2026-10-28T00:17:11.357

Link: CVE-2026-104895

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:30:14Z

Weaknesses
  • CWE-789

    Memory Allocation with Excessive Size Value