During CBOR parsing, the Jackson‑Dataformat‑CBOR library collects semantic tags in a TagList array. The array grows by a fixed increment of eight items instead of doubling, triggering a full copy on each growth. An attacker who injects an unbounded chain of tag bytes before a trivial value forces the parser to perform O(N²) operations, producing excessive CPU usage and garbage collection pressure. This leads to an algorithmic‑complexity denial‑of‑service where the parsing thread is pinned and concurrent requests can exhaust the thread pool.

The flaw affects the FasterXML jackson‑dataformat‑cbor module, starting with version 2.18.2 and any later release in the 2.x and 3.x series. Any application that deserializes CBOR data through this library—especially those exposed to untrusted input over the network—may be impacted.

Based on the description, it is inferred that an attacker can trigger the DoS by supplying crafted CBOR data that contains an unbounded number of stacked tags. The attack does not require privileged access, authentication, or memory corruption, and can be delivered through any interface that deserializes CBOR. The EPSS score is not available; this is inferred from the absence of a value in the data. The vulnerability is not listed in the CISA KEV catalog. Because the DoS relies on computational complexity rather than resource limits, services that process large volumes or high‑frequency CBOR streams are at higher risk and can saturate CPU or garbage collection, leading to service interruption.