CVE-2026-104895

A flaw was found in jackson-dataformat-smile. A remote attacker can cause a Denial of Service (DoS) by submitting specially crafted binary data to an asynchronous parsing endpoint. The parser fails to validate length prefixes, allowing untrusted input to trigger integer overflows or excessive memory allocations without upper bounds. Successful exploitation results in an application or processing thread crash.

This vulnerability is rated as Important because unauthenticated remote attackers can trigger an application crash or service denial using minimal network traffic, though data confidentiality and integrity are not compromised. Exploitation is constrained to endpoints explicitly configured to process untrusted binary input via reactive or asynchronous Smile parsers. Typical deployments using standard blocking parsers or conventional JSON serialization are not vulnerable to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.