CVE-2026-104016: Integer Overflow
ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (inputPtr + len) <= inputEnd and then, on the fast path, calling finishShortText(len). Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr + len overflows to a negative value, the bounds check passes, and finishShortText(len) reaches TextBuffer.expandCurrentSegment(len), which performs Arrays.copyOf with no cap and throws OutOfMemoryError: Requested array size exceeds VM limit.
The JVM refuses arrays larger than Integer.MAXVALUE - 8 before consulting available heap, so -Xmx tuning does not mitigate the issue. StreamReadConstraints.maxStringLength and maxDocumentLength do not gate this path: a 33-byte payload is far below any document-length cap and the string-length check does not fire before the allocation. This was confirmed empirically against shipping artifacts with maxStringLength, maxDocumentLength and maxNestingDepth all configured.
A February 2026 hardening commit added the equivalent overflow guard to the packed-array-length and message-length paths but left the string-length call sites unguarded. No privileges or user interaction beyond the ability to submit data for parsing are required.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to trigger the issue?
The attack is network-reachable and requires no privileges or user interaction. A vulnerable service must parse attacker-controlled protobuf input.
Do Jackson stream-read limits prevent exploitation?
No. The issue was confirmed with maxStringLength, maxDocumentLength, and maxNestingDepth configured; the affected payload can be 33 bytes and the string-length check does not run before the oversized allocation.
Can increasing the JVM heap limit prevent the denial of service?
No. The JVM rejects the requested array size before available heap is considered, so changing -Xmx does not mitigate the failure.
What evidence indicates an exploitation attempt or impact?
A malicious protobuf length value near Integer.MAX_VALUE can cause an OutOfMemoryError with the message "Requested array size exceeds VM limit" during protobuf string or bytes field parsing.