FasterXML

CVE-2026-104895: The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is re

CVE-2026-104895 Oct 28, 2026 Source: Vendor

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately.

A Smile feed of roughly ten bytes can th

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-104895

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines

Showing 1–2 of 2

CVE-2026-104895 BR2026-0000-036453 unclaimed

Credited as apvxlab (AppViewX security research)

CVE-2026-104895 BR2026-0000-036454 unclaimed

Credited as Michael-JRead