CLEANSTART-2026-UT29597: Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints
Security vulnerability affects the elasticsearch package. The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/elasticsearchto a version that resolves this vulnerability.Fixed in 9.2.8-r13
Frequently Asked Questions
Who can exploit this issue?
The vector is network-accessible, requires no privileges or user interaction, and has low attack complexity. An attacker who can send crafted Smile-formatted input to a vulnerable parsing path could trigger an availability impact.
What is the expected impact of successful exploitation?
The reported impact is limited to availability, with no confidentiality or integrity impact indicated. The issue is rated high severity with a score of 7.5.
Is the default configuration known to be affected?
The available information does not state whether Smile parsing is enabled or reachable in the default elasticsearch configuration. Exposure depends on whether the deployment accepts attacker-controlled Smile-formatted data through the affected parser.