com.fasterxml.jackson.dataformat:jackson-dataformat-cbor vulnerabilities

CVEs whose affected-version data names the com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-68495High· 7.5PoC

today

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format

The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. CBORParser._decodeLong…

▾ MidnightFasterXML · com.fasterxml.jackson.dataformat:jackson-dataformat-cborvia NVD