Bug 2567888 (CVE-2026-106554)

Summary: CVE-2026-106554 com.fasterxml.jackson.dataformat/jackson-dataformat-cbor: jackson-dataformat-cbor: Denial of Service via unbounded CBOR tags
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: aschwart, aszczucz, boliveir, drichtar, ehelms, fmariani, gmalinko, janstey, jpasqual, juwatts, jwon, lblicha, mcarlett, mhulan, mposolda, ogajduse, osousa, pdelbell, pjindal, rchan, rhel-process-autobot, rmartinc, rstepani, smallamp, ssilvert, sthorger, tcunning, vmuzikar, watson-tool-maintainers, yfang, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in jackson-dataformat-cbor. A remote attacker can supply a specially crafted Concise Binary Object Representation (CBOR) stream containing an excessive sequence of stacked semantic tags before a data item. Because the parser accumulates these tags without an upper bound and resizes its internal storage inefficiently, processing the input requires disproportionate processing time and memory. This flaw leads to thread exhaustion and excessive processor utilization, resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 22:34:03 UTC 
One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).



PoC executed against com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:2.18.2; present in current 2.x and 3.x (tools.jackson.dataformat.cbor) HEAD. Distinct from the Avro and Smile/Protobuf advisories for this repo.



Quadratic CPU/GC DoS from an unbounded chain of CBOR tags (PoC-proven). File: cbor/src/main/java/.../cbor/CBORParser.java (tag handling -> TagList).



CBOR permits a data item to be preceded by any number of semantic tags. The CBOR parser accumulates them in a TagList whose backing array grows by a fixed increment (+8), not by doubling, and re-scans/copies on each growth. An attacker sends a value preceded by a long run of tag bytes; the fixed-increment growth makes accumulating N tags O(N^2) in time (plus GC pressure), with no cap on the number of stacked tags.



PoC (executed, JDK 17): feeding a CBOR stream consisting of a long run of tag bytes (e.g. tag 0xC0+) before a trivial value forces quadratic CPU/GC; parse time grows super-linearly with the tag count, pinning a request thread with no configurable limit.



Impact. Algorithmic-complexity denial of service (CWE-407): a modest input of stacked tags consumes quadratic CPU/GC, pinning a request thread; concurrent requests exhaust the pool.



Fix. Grow TagList by doubling and/or cap the number of stacked tags (StreamReadConstraints-style).