Technical impact
The Smile parser in FasterXML jackson‑dataformats‑binary does not invoke the StreamReadConstraints.validateNameLength() check when decoding JSON object property names. As a result, an attacker can craft a single property name of unbounded length and cause the parser to allocate and buffer the entire name before any limit is applied. Because StreamReadConstraints.maxDocumentLength is disabled by default, nothing else bounds the name under default settings. The only practical restrictions are the amount of data the attacker can supply and the JVM heap size, leading to memory exhaustion and denial of service with no additional privileges required.
Affected Systems
All releases of FasterXML jackson‑dataformats‑binary that have not been updated to one of the fixed builds are affected. Specifically, older versions in the 2.18.x, 2.21.x, 2.22.x, 3.1.x and 3.2.x lines are vulnerable; the 2.16.x, 2.17.x, 2.19.x, 2.20.x, and 3.0.x branches received no fix and are no longer maintained upstream. Upgrading to com.fasterxml.jackson.dataformat:jackson‑dataformat‑smile 2.18.10, 2.21.6, 2.22.2, or tools.jackson.dataformat:jackson‑dataformat‑smile 3.1.6 or 3.2.2 removes the exploit.
Risk and Exploitability
The CVSS score is 7.5, indicating a moderate-to-high risk. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, so no current evidence of widespread exploitation exists. Attackers only need the ability to send Smile‑formatted data to the parser – this could be over a network endpoint, a file upload, or any other interface that deserializes incoming data. The attack path requires no elevated privileges and exploits a resource exhaustion flaw (CWE‑400/770); successful exploitation would result in an application or service becoming unresponsive, potentially impacting availability for all users of that service.
