CVE-2026-68495: FasterXML jackson-dataformats-binary CBOR parser unbounded name length denial of service

CVE-2026-68495 · Severity: high · CVSS 7.5 · Published 2026-10-01

The CBOR parser in jackson-dataformats-binary fails to enforce property name length limits when parsing binary data documents. An attacker who submits a specially crafted CBOR document with an extremely long property name can exhaust the application's memory, causing the service to crash or become unresponsive, resulting in denial of service with no special privileges required.

Vendors: FasterXML.

Quick answers

Is CVE-2026-68495 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-68495 being exploited in the wild.
How severe is CVE-2026-68495?
High severity, with a CVSS score of 7.5, published 1 October 2026.
Which products and versions are affected?
FasterXML Jackson-Dataformats-Binary versions before 2.16.0 are unaffected (constraint did not exist); 2.16.0 and later with CBOR parsing enabled.
Is there a fix for CVE-2026-68495?
No fixed version is recorded yet. Applications should restrict the maximum acceptable document size and configure maxNameLength constraints if using jackson-core 2.16.0 or later, or avoid parsing untrusted CBOR documents until a patched version is available.</anigation> </invoke> If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-68495 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-68495?
Check whether you run FasterXML Jackson-Dataformats-Binary at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Applications should restrict the maximum acceptable document size and configure maxNameLength constraints if using jackson-core 2.16.0 or later, or avoid parsing untrusted CBOR documents until a patched version is available.</anigation> </invoke>

Technical details

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() during JSON object property name decoding, allowing unbounded name lengths. The vulnerable code paths are CBORParser._decodeLongerName() which performs no length check, and CBORParser._decodeChunkedName() which validates maxStringLength instead of maxNameLength. An unauthenticated attacker can submit a CBOR document with a property name of arbitrary length; the parser buffers the entire name in memory before returning it, leading to heap exhaustion and denial of service.

Affected products

  • FasterXML jackson-dataformats-binary versions before 2.16.0 are unaffected (constraint did not exist); 2.16.0 and later with CBOR parsing enabled

Timeline

  • 2026-10-01: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.