# CVE-2026-104016: Jackson dataformat-protobuf integer overflow in string parsing

Source: https://junglewise.ai/threats/cve-2026-104016-protobufparser-parses-length-prefixed-protobuf-string-and-bytes  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-104016 · Severity: high · CVSS 7.5 · Published 2026-10-28

Jackson dataformat-protobuf is a Java library for parsing Protocol Buffer messages. An attacker can send a specially crafted protobuf payload that causes the parser to attempt to allocate an extremely large array, resulting in an out-of-memory error that crashes the application. No authentication or user interaction is required—only the ability to submit data for parsing.

Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml).

## Quick answers

**Is CVE-2026-104016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104016 being exploited in the wild.

**How severe is CVE-2026-104016?** High severity, with a CVSS score of 7.5, published 28 October 2026.

**Which products and versions are affected?** FasterXML Jackson-Dataformat-Protobuf 2.6.0–2.18.11, 2.19.0–2.21.7, 2.22.0–2.22.3, 3.0.0–3.1.7, 3.2.0–3.2.3; FasterXML Jackson-Dataformat-Protobuf (Tools.Jackson.Dataformat) 3.0.0–3.1.7, 3.2.0–3.2.3.

**Is there a fix for CVE-2026-104016?** Yes: fixed in jackson-dataformat-protobuf 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-104016 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-104016?** Check whether you run FasterXML Jackson-Dataformat-Protobuf or FasterXML Jackson-Dataformat-Protobuf (Tools.Jackson.Dataformat) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in jackson-dataformat-protobuf 2.18.12, 2.21.8, 2.22.4, 3.1.8, 3.2.4

## Technical details

A signed 32-bit integer overflow in the string and bytes field parsing path allows an attacker to bypass length bounds checks by supplying a varint length near Integer.MAX_VALUE. When _inputPtr + len is computed, it overflows to a negative value, causing the check (_inputPtr + len) <= _inputEnd to pass. The code then calls _finishShortText(len) which invokes TextBuffer.expandCurrentSegment(len), triggering Arrays.copyOf with an attacker-controlled size that exceeds Integer.MAX_VALUE - 8, causing a denial-of-service OutOfMemoryError. StreamReadConstraints on maxStringLength and maxDocumentLength do not guard this code path.

## Affected products

- FasterXML jackson-dataformat-protobuf 2.6.0–2.18.11, 2.19.0–2.21.7, 2.22.0–2.22.3, 3.0.0–3.1.7, 3.2.0–3.2.3
- FasterXML jackson-dataformat-protobuf (tools.jackson.dataformat) 3.0.0–3.1.7, 3.2.0–3.2.3

## Timeline

- 2026-10-28: disclosed
- 2026-10-20: advisory: GitHub security advisory published

## References

- [https://repo.maven.apache.org/maven2](https://repo.maven.apache.org/maven2)
- [https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-c2rq-mcfv-jw29](https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-c2rq-mcfv-jw29)