{
  "cveId": "CVE-2026-110747",
  "url": "https://patchblox.com/security/cve/CVE-2026-110747",
  "summary": "CVE-2026-110747 is fixed in jackson-dataformats-binary on 1 platform by DEBIAN-CVE-2026-110747 (version 2.22.4-1), released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "jackson-dataformats-binary: ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry\u0027s string key into an attacker-control...",
  "description": "ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry\u0027s string key into an attacker-controlled int and then checks (_inputPtr \u002B len) \u003C= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.    An 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:\u002BExitOnOutOfMemoryError terminate the JVM.    This is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.",
  "published": "2026-10-28T01:16:55Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00387,
  "epssPercentile": 0.33109,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "jackson-dataformats-binary",
      "release": "Debian 14",
      "fixedVersion": "2.22.4-1",
      "fix": "DEBIAN-CVE-2026-110747",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-110747",
      "released": "2026-11-03T18:58:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T19:12:23Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}