The vulnerability is an integer overflow in ProtobufParser._readStringKey() that causes the parser to incorrectly accept a declared string key length up to 2,147,483,647 bytes. When the sum of the current input pointer and this length overflows to a negative number, the bounds check passes even though no key data exists. The parser then attempts to allocate a text buffer of the declared size, which triggers an OutOfMemoryError. Applications that do not handle this exception can crash, and systems configured with -XX:+ExitOnOutOfMemoryError will terminate the entire JVM. This leads to a denial of service that can be triggered by any attacker able to supply malicious Protobuf data.

The flaw exists in FasterXML’s jackson-dataformat-protobuf library. The vulnerable code path was introduced on the 2.x branch with version 2.21.6 and on the 3.x branches starting with 3.1.6 and 3.2.2. Versions 2.18–2.20, 3.0, and 3.1.0–3.1.5/3.2.0–3.2.1 are not affected. Clients using 2.21.6 or later, or 3.1.6+ / 3.2.2+, must be reviewed.

With a CVSS score of 7.5 the vulnerability is classified as high severity. No exploit probability score is available, and the issue is not listed in CISA’s KEV catalog. An attacker can exploit it remotely simply by submitting a crafted Protobuf message containing a map entry with a key length of 0x7FFFFFFF. No special privileges or interaction are required beyond providing input to the parser. Because standard StreamReadConstraints do not prevent the overflow, the sole safeguards are an updated library, application logic, or JVM configuration changes.