CVE-2026-104895 The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] b
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-104895?
CVE-2026-104895 is a high-severity vulnerability in FasterXML jackson-dataformat-smile, published on 28 Oct 2026.
Official description
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.
A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread.
This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.
Weakness: CWE-789
Which versions are affected by CVE-2026-104895?
How do I fix CVE-2026-104895?
No fix has been published for CVE-2026-104895 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-104895 being exploited?
There is no known exploitation of CVE-2026-104895 in the wild and no public exploit code.
Sources
Also known as GHSA-h3c2-2m49-r49w.