{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-110747 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-110747 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-110747 is a high-severity vulnerability in FasterXML jackson-dataformat-protobuf, published on 28 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-110747 and fix it if it is affected.\n\nWhat it is: CVE-2026-110747 is a high-severity vulnerability in FasterXML jackson-dataformat-protobuf, published on 28 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-110747 in the wild and no public exploit code.\n\nAffected product: FasterXML jackson-dataformat-protobuf. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-110747/ (Markdown: https://insights.sbomify.com/CVE-2026-110747/index.md)","id":"CVE-2026-110747","markdown":"https://insights.sbomify.com/CVE-2026-110747/index.md","name":"CVE-2026-110747","record":{"aliases":["GHSA-fv7v-rrmh-4qcv"],"analysis":null,"analysis_generated_by":null,"assigner":"HeroDevs","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"description":"ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) \u003c= _inputEnd using signed arithmetic. For values near Integer.MAX_VALUE the addition overflows to a negative value and the check passes even when the input contains no key data. The parser then calls _finishShortText(len), which expands the text buffer to the declared length via TextBuffer.expandCurrentSegment and Arrays.copyOf, throwing OutOfMemoryError: Requested array size exceeds VM limit.\n\nAn 8-byte malformed message containing a map entry with a declared key length of 0x7FFFFFFF is sufficient. Configured StreamReadConstraints, including maxStringLength, maxNameLength, maxDocumentLength and maxNestingDepth, do not prevent the failure. Applications running with -XX:+ExitOnOutOfMemoryError terminate the JVM.\n\nThis is the same integer-overflow pattern addressed for other call sites in the remediation associated with CVE-2026-104016 and CVE-2026-104017; the map-key call site was corrected on the 3.x branches only, leaving the corresponding 2.x branches unguarded. Release lines 2.18, 2.19 and 2.20 do not contain _readStringKey() and are not affected by this vector. No privileges or user interaction beyond the ability to submit data for parsing are required. The 3.0 release line and 3.1.0-3.1.5 / 3.2.0-3.2.1 do not contain _readStringKey() and are therefore not affected; the method first appears in 3.1.6 and 3.2.2, mirroring its introduction at 2.21.6 on the 2.x side.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks","id":"CVE-2026-110747","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":1,"next":{"headline":"Apache SIS: CWE-22: improper limitation of paths to GML, GeoTIFF, NADCON or NTv2 files","id":"CVE-2026-110748"},"packages":[],"prev":{"headline":"CVE-2026-110746","id":"CVE-2026-110746"},"products":["jackson-dataformat-protobuf"],"published":"2026-10-28","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-28","vendors":["FasterXML"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-110747/"}