Is CVE-2026-104016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104016 being exploited in the wild.

How severe is CVE-2026-104016?

High severity, with a CVSS score of 7.5, published 28 October 2026.

Which products and versions are affected?

FasterXML Jackson-Dataformat-Protobuf 2.6.0–2.18.11, 2.19.0–2.21.7, 2.22.0–2.22.3, 3.0.0–3.1.7, 3.2.0–3.2.3; FasterXML Jackson-Dataformat-Protobuf (Tools.Jackson.Dataformat) 3.0.0–3.1.7, 3.2.0–3.2.3.

Is there a fix for CVE-2026-104016?

Yes: fixed in jackson-dataformat-protobuf 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-104016 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-104016?

Check whether you run FasterXML Jackson-Dataformat-Protobuf or FasterXML Jackson-Dataformat-Protobuf (Tools.Jackson.Dataformat) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104016: Jackson dataformat-protobuf integer overflow in string parsing

CVE-2026-104016 · Severity: high · CVSS 7.5 · Published 2026-10-28

Jackson dataformat-protobuf is a Java library for parsing Protocol Buffer messages. An attacker can send a specially crafted protobuf payload that causes the parser to attempt to allocate an extremely large array, resulting in an out-of-memory error that crashes the application. No authentication or user interaction is required—only the ability to submit data for parsing.

Vendors: FasterXML.

Quick answers

Is CVE-2026-104016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104016 being exploited in the wild.
How severe is CVE-2026-104016?: High severity, with a CVSS score of 7.5, published 28 October 2026.
Which products and versions are affected?: FasterXML Jackson-Dataformat-Protobuf 2.6.0–2.18.11, 2.19.0–2.21.7, 2.22.0–2.22.3, 3.0.0–3.1.7, 3.2.0–3.2.3; FasterXML Jackson-Dataformat-Protobuf (Tools.Jackson.Dataformat) 3.0.0–3.1.7, 3.2.0–3.2.3.
Is there a fix for CVE-2026-104016?: Yes: fixed in jackson-dataformat-protobuf 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-104016 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-104016?: Check whether you run FasterXML Jackson-Dataformat-Protobuf or FasterXML Jackson-Dataformat-Protobuf (Tools.Jackson.Dataformat) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: jackson-dataformat-protobuf 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4

Technical details

A signed 32-bit integer overflow in the string and bytes field parsing path allows an attacker to bypass length bounds checks by supplying a varint length near Integer.MAX_VALUE. When _inputPtr + len is computed, it overflows to a negative value, causing the check (_inputPtr + len) <= _inputEnd to pass. The code then calls _finishShortText(len) which invokes TextBuffer.expandCurrentSegment(len), triggering Arrays.copyOf with an attacker-controlled size that exceeds Integer.MAX_VALUE - 8, causing a denial-of-service OutOfMemoryError. StreamReadConstraints on maxStringLength and maxDocumentLength do not guard this code path.

Affected products

FasterXML jackson-dataformat-protobuf 2.6.0–2.18.11, 2.19.0–2.21.7, 2.22.0–2.22.3, 3.0.0–3.1.7, 3.2.0–3.2.3
FasterXML jackson-dataformat-protobuf (tools.jackson.dataformat) 3.0.0–3.1.7, 3.2.0–3.2.3

Timeline

2026-10-28: disclosed
2026-10-20: advisory: GitHub security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.