CLEANSTART-2026-CI98008: One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven)
Security vulnerability affects the elasticsearch package. One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/elasticsearchto a version that resolves this vulnerability.Fixed in 9.2.8-r13
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it by supplying CBOR input containing an unbounded run of CBOR tags. Exploitation does not require user interaction or prior privileges.
What is the likely impact of a successful attack?
The malformed CBOR input can cause quadratic-time TagList growth, leading to CPU and garbage-collection exhaustion. This can result in denial of service; the provided severity vector indicates no confidentiality or integrity impact.
How can I determine whether my deployment is exposed?
Determine whether the affected Elasticsearch package processes attacker-controlled or otherwise untrusted CBOR data. The issue is in the jackson-dataformats-binary CBOR module, and the available data does not identify affected versions or configurations.