Is CVE-2026-110747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110747 being exploited in the wild.

How severe is CVE-2026-110747?

High severity, with a CVSS score of 7.5, published 28 October 2026.

Which products and versions are affected?

FasterXML Jackson Databind 2.21.6 through 2.x; 3.1.6 through 3.1.5; 3.2.2 through 3.2.1.

Is there a fix for CVE-2026-110747?

Yes: fixed in . Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110747 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110747?

Check whether you run FasterXML Jackson Databind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110747: Jackson Protobuf Parser integer overflow in string key parsing

CVE-2026-110747 · Severity: high · CVSS 7.5 · Published 2026-10-28

Jackson's protobuf parser contains an integer overflow vulnerability in how it processes map entry keys from untrusted protobuf messages. An attacker can craft a malformed 8-byte message that causes the parser to allocate an excessively large memory buffer, exhausting heap memory and crashing the JVM. Applications configured to crash on out-of-memory conditions will terminate immediately.

Technologies: FasterXML Jackson Databind. Vendors: FasterXML.

Quick answers

Is CVE-2026-110747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110747 being exploited in the wild.
How severe is CVE-2026-110747?: High severity, with a CVSS score of 7.5, published 28 October 2026.
Which products and versions are affected?: FasterXML Jackson Databind 2.21.6 through 2.x; 3.1.6 through 3.1.5; 3.2.2 through 3.2.1.
Is there a fix for CVE-2026-110747?: Yes: fixed in <UNKNOWN>. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110747 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110747?: Check whether you run FasterXML Jackson Databind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: <UNKNOWN>

Technical details

The ProtobufParser._readStringKey() method reads a length prefix for a protobuf map entry's string key into a signed int and performs a bounds check using signed arithmetic. When the length is near Integer.MAX_VALUE (0x7FFFFFFF), the addition (_inputPtr + len) overflows to a negative value, bypassing the bounds check. The parser then attempts to allocate and fill a text buffer of the declared size, triggering OutOfMemoryError. StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not prevent this overflow.

Affected products

FasterXML Jackson Databind 2.21.6 through 2.x; 3.1.6 through 3.1.5; 3.2.2 through 3.2.1

Timeline

2026-10-28: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.