# CVE-2026-110747: Jackson Protobuf Parser integer overflow in string key parsing

Source: https://junglewise.ai/threats/cve-2026-110747-protobufparser-readstringkey-reads-the-length-prefix-of-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-110747 · Severity: high · CVSS 7.5 · Published 2026-10-28

Jackson's protobuf parser contains an integer overflow vulnerability in how it processes map entry keys from untrusted protobuf messages. An attacker can craft a malformed 8-byte message that causes the parser to allocate an excessively large memory buffer, exhausting heap memory and crashing the JVM. Applications configured to crash on out-of-memory conditions will terminate immediately.

Technologies: [FasterXML Jackson Databind](https://junglewise.ai/threats/technologies/jackson-databind). Vendors: [FasterXML](https://junglewise.ai/threats/vendors/fasterxml).

## Quick answers

**Is CVE-2026-110747 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110747 being exploited in the wild.

**How severe is CVE-2026-110747?** High severity, with a CVSS score of 7.5, published 28 October 2026.

**Which products and versions are affected?** FasterXML Jackson Databind 2.21.6 through 2.x; 3.1.6 through 3.1.5; 3.2.2 through 3.2.1.

**Is there a fix for CVE-2026-110747?** Yes: fixed in <UNKNOWN>. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110747 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-110747?** Check whether you run FasterXML Jackson Databind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in <UNKNOWN>

## Technical details

The ProtobufParser._readStringKey() method reads a length prefix for a protobuf map entry's string key into a signed int and performs a bounds check using signed arithmetic. When the length is near Integer.MAX_VALUE (0x7FFFFFFF), the addition (_inputPtr + len) overflows to a negative value, bypassing the bounds check. The parser then attempts to allocate and fill a text buffer of the declared size, triggering OutOfMemoryError. StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not prevent this overflow.

## Affected products

- FasterXML Jackson Databind 2.21.6 through 2.x; 3.1.6 through 3.1.5; 3.2.2 through 3.2.1

## Timeline

- 2026-10-28: disclosed

## Related threats

- [jackson-databind type validation bypass in generic arguments](https://junglewise.ai/threats/cve-2026-110879-jackson-databind-validates-the-outer-class-of-a-class-name-type)
- [jackson-databind quadratic complexity in forward-reference resolution](https://junglewise.ai/threats/cve-2026-91777-jackson-databind-quadratic-forward-reference-completion)
- [FasterXML Jackson Databind unbounded cache growth on unknown type IDs](https://junglewise.ai/threats/cve-2026-91776-jackson-databind-retains-every-unknown-raw-type-id)
- [FasterXML jackson-databind quadratic parse in XML datatype deserialization](https://junglewise.ai/threats/cve-2026-68497-fasterxml-jackson-databind-quadratic-parse-in-xml-datatype)
- [FasterXML Jackson Databind unsafe polymorphic type deserialization](https://junglewise.ai/threats/cve-2026-83557-fasterxml-jackson-databind-unsafe-polymorphic-type)