jackson-dataformat-protobuf Integer Overflow Flaws

Denial of service in jackson-dataformat-protobuf (2.21.6-2.21.7, 2.22.0-2.22.3, 3.1.6-3.1.7 and 3.2.2-3.2.3) lets an 8-byte malformed protobuf message force an oversized buffer allocation that ends in OutOfMemoryError, so any application that streaming-parses untrusted protobuf against a schema containing a string-keyed map (map<string, V>) is exposed. The overflow occurs in ProtobufParser._readStringKey(), where a declared key length of 0x7FFFFFFF wraps the signed bounds check and reaches TextBuffer.expandCurrentSegment(); StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not block it, and JVMs started with -XX:+ExitOnOutOfMemoryError terminate outright (observed exit code 3). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), consistent with pure availability impact and no demonstrated confidentiality or integrity effect; a working proof-of-concept payload is documented in the vendor advisory, but there is no CISA KEV listing and no confirmed active exploitation, and the vuln.today decision label places remediation in this week's queue.

OutOfMemoryError denial of service in jackson-dataformat-protobuf allows a remote unauthenticated attacker to crash a protobuf-consuming service with a 33-byte payload when a length-prefixed string or bytes field has an attacker-controlled varint length near Integer.MAX_VALUE. Affected packages are com.fasterxml.jackson.dataformat:jackson-dataformat-protobuf through 2.22.3 (including 2.18.11 and 2.21.7) and tools.jackson.dataformat:jackson-dataformat-protobuf through 3.2.3 (including 3.1.7); default ProtobufMapper configurations are vulnerable, and the evidence confirms that maxStringLength, maxDocumentLength, maxNestingDepth, and -Xmx tuning do not prevent the allocation failure. This is a genuine but bounded priority: impact is availability-only, and exploitation requires that the service deserialize attacker-reachable protobuf using a schema with an attacker-influenced string or bytes field; the advisory includes a 33-byte reproduction confirmed against shipping 2.21.7 and 3.1.7 jars, while no CISA KEV listing is indicated.