CVE-2026-104016 is an integer overflow vulnerability in FasterXML jackson-dataformat-protobuf affecting multiple version ranges before fixed releases. The flaw occurs during parsing of length-prefixed protobuf string and bytes fields, where 32-bit signed integer arithmetic overflow allows bypassing bounds checks. This leads to an attempt to allocate an excessively large array, causing an OutOfMemoryError. The issue cannot be mitigated by JVM heap size tuning or existing string/document length limits. No special privileges or user interaction are required beyond submitting data for parsing. Fixed versions are available.