CLEANSTART-2026-HQ46712: One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven)
CVE-2026-106554 affects multiple packages. One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time TagList growth (CPU/GC-exhaustion DoS, PoC-proven). See references for individual vulnerability details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/wso2amto a version that resolves this vulnerability.Fixed in 4.7.0-r5 - Upgrade
Upgrade
cleanstart/rundeckto a version that resolves this vulnerability.Fixed in 6.0.1-r11 - Upgrade
Upgrade
cleanstart/keycloakto a version that resolves this vulnerability.Fixed in 26.8.2-r0 - Upgrade
Upgrade
cleanstart/solrto a version that resolves this vulnerability.Fixed in 9.11.0-r3
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to send a crafted CBOR payload containing an unbounded run of CBOR tags to a vulnerable CBOR parser. The supplied vector indicates network exploitation requires no privileges or user interaction.
Which affected deployments are exposed?
Deployments of the listed cleanstart/wso2am, cleanstart/rundeck, cleanstart/keycloak, or cleanstart/solr packages are relevant where they process attacker-controlled CBOR data through jackson-dataformats-binary's CBOR module.
What is the expected impact of exploitation?
The crafted tag sequence causes quadratic-time TagList growth, which can exhaust CPU and garbage-collection resources. This can result in a denial of service; no confidentiality or integrity impact is identified in the provided vector.