Fasterxml Jackson-Dataformat-Protobuf
2 CVEs affecting Fasterxml Jackson-Dataformat-Protobuf. Latest disclosed: 2026-10-28. Critical: 0, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-110747 | High | 7.5 | 2026-10-28 | ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len)… |
CVE-2026-104016 | High | 7.5 | 2026-10-28 | ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path, calling _finishSh… |