Resource exhaustion in Jackson Dataformats Binary - CVE-2026-68496,CVE-2026-68495

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU156659

Resource exhaustion in Jackson Dataformats Binary - CVE-2026-68496,CVE-2026-68495

Published: October 21, 2026 / Updated: October 21, 2026


Vulnerability identifier: #VU156659
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-68496,CVE-2026-68495
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service through excessive memory consumption.

The vulnerability exists due to missing enforcement of the maxNameLength constraint in the Jackson Dataformats Binary Smile and CBOR parsers when decoding object property names. A remote attacker can submit a crafted Smile or CBOR document containing an excessively long property name that is buffered entirely in memory without enforcing the configured name-length limit to exhaust available memory and cause a denial of service.


Affected software

Jackson Dataformats Binary
InfoSphere Data Replication

How to mitigate CVE-2026-68496,CVE-2026-68495

Install security update from vendor's website.

Jackson Dataformats Binary - addressed in versions 2.18.10, 2.21.6, 2.22.2, 3.1.6, 3.2.2
InfoSphere Data Replication - update to 11.4.0.5-5826

External References

Related Security Bulletins