Threats affecting pkg:maven/com.fasterxml.jackson.dataformat/jackson-dataformat-cbor

CVE-2026-106554 is an algorithmic complexity vulnerability in the jackson-dataformat-cbor library's CBOR parser. The parser accumulates CBOR semantic tags in a TagList that grows by a fixed increment, causing quadratic-time growth in CPU and garbage collection when processing an unbounded run of tags. This can lead to denial of service by exhausting CPU and GC resources. The issue affects multiple 2.x and 3.x versions and has been fixed by improving TagList growth and capping stacked tags.

CVE-2026-68495 is a high-severity vulnerability in the CBOR parser of FasterXML jackson-dataformats-binary. The parser does not enforce the maxNameLength limit when decoding JSON object property names in CBOR format, allowing an attacker to submit a property name of unbounded length. This can lead to memory exhaustion and denial of service due to unbounded memory allocation during parsing. No special privileges are required beyond the ability to submit data to the parser. The issue affects multiple versions starting from 2.16.0 where the maxNameLength constraint was introduced but not enforced in this parser. The vulnerability is tracked alongside a related Smile parser defect under the same vendor advisory.