Jackson Dataformat Protobuf
Monthly
Denial of service in jackson-dataformat-protobuf (2.21.6-2.21.7, 2.22.0-2.22.3, 3.1.6-3.1.7 and 3.2.2-3.2.3) lets an 8-byte malformed protobuf message force an oversized buffer allocation that ends in OutOfMemoryError, so any application that streaming-parses untrusted protobuf against a schema containing a string-keyed map (map<string, V>) is exposed. The overflow occurs in ProtobufParser._readStringKey(), where a declared key length of 0x7FFFFFFF wraps the signed bounds check and reaches TextBuffer.expandCurrentSegment(); StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not block it, and JVMs started with -XX:+ExitOnOutOfMemoryError terminate outright (observed exit code 3). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), consistent with pure availability impact and no demonstrated confidentiality or integrity effect; a working proof-of-concept payload is documented in the vendor advisory, but there is no CISA KEV listing and no confirmed active exploitation, and the vuln.today decision label places remediation in this week's queue.
Denial of service in jackson-dataformat-protobuf (2.21.6-2.21.7, 2.22.0-2.22.3, 3.1.6-3.1.7 and 3.2.2-3.2.3) lets an 8-byte malformed protobuf message force an oversized buffer allocation that ends in OutOfMemoryError, so any application that streaming-parses untrusted protobuf against a schema containing a string-keyed map (map<string, V>) is exposed. The overflow occurs in ProtobufParser._readStringKey(), where a declared key length of 0x7FFFFFFF wraps the signed bounds check and reaches TextBuffer.expandCurrentSegment(); StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not block it, and JVMs started with -XX:+ExitOnOutOfMemoryError terminate outright (observed exit code 3). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), consistent with pure availability impact and no demonstrated confidentiality or integrity effect; a working proof-of-concept payload is documented in the vendor advisory, but there is no CISA KEV listing and no confirmed active exploitation, and the vuln.today decision label places remediation in this week's queue.