Jackson Dataformat Smile
Monthly
Eager, unbounded memory allocation in the asynchronous Smile parser (NonBlockingByteArrayParser) lets a Smile feed of roughly ten bytes force a byte[] allocation of approximately 2 GB before any body bytes are consumed, producing an OutOfMemoryError that crashes the request or processing thread on reactive/async Smile endpoints; a VInt crafted to overflow int instead yields a negative length and a NegativeArraySizeException that is not a JacksonException and so escapes the parser contract. Only applications that construct the non-blocking parser via SmileFactory.createNonBlockingByteArrayParser and feed it attacker-supplied Smile bytes are exposed - the blocking SmileParser already contains the (value >>> 25) overflow guard - and no authentication, privileges or user interaction are required beyond the ability to submit data for parsing (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-789). No public exploit code has been identified at time of analysis, although the upstream advisory includes a code-verified reproduction recipe, and fixes are published across all supported branches.
Eager, unbounded memory allocation in the asynchronous Smile parser (NonBlockingByteArrayParser) lets a Smile feed of roughly ten bytes force a byte[] allocation of approximately 2 GB before any body bytes are consumed, producing an OutOfMemoryError that crashes the request or processing thread on reactive/async Smile endpoints; a VInt crafted to overflow int instead yields a negative length and a NegativeArraySizeException that is not a JacksonException and so escapes the parser contract. Only applications that construct the non-blocking parser via SmileFactory.createNonBlockingByteArrayParser and feed it attacker-supplied Smile bytes are exposed - the blocking SmileParser already contains the (value >>> 25) overflow guard - and no authentication, privileges or user interaction are required beyond the ability to submit data for parsing (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-789). No public exploit code has been identified at time of analysis, although the upstream advisory includes a code-verified reproduction recipe, and fixes are published across all supported branches.