Register | Log in

jackson-dataformat-smile

Choose email to subscribe with

general

source: jackson-dataformat-smile (main)
version: 2.7.8-5+deb13u1
maintainer: Debian Java Maintainers (archive) (DMD)
uploaders: Hilko Bengen (DMD)
arch: all
std-ver: 4.6.0
VCS: Git (Browse)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.7.8-3
o-o-sec: 2.7.8-3+deb11u1
oldstable: 2.7.8-5+deb12u1
old-sec: 2.7.8-5+deb12u1
old-p-u: 2.7.8-5+deb12u1
stable: 2.7.8-5+deb13u1
stable-sec: 2.7.8-5+deb13u1

versioned links

2.7.8-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.7.8-3+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.7.8-5+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.7.8-5+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjackson2-dataformat-smile

package is gone

This package is not in any development repository. This probably means that the package has been removed (or has been renamed). Thus the information here is of little interest ... the package is going to disappear unless someone takes it over and reintroduces it.

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-104895: The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

Created: 2026-11-08 Last update: 2026-11-08 02:00

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-104895: The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes (value << 6) + (i & 0x3F) without the (value >>> 25) != 0 overflow guard present in the blocking SmileParser._readUnsignedVInt, and _startRawBinary then allocates the declared length immediately. A Smile feed of roughly ten bytes can therefore force an eager allocation of approximately 2 GB, producing an OutOfMemoryError on reactive or asynchronous Smile endpoints. A VInt crafted to overflow int yields a negative length and a NegativeArraySizeException, a RuntimeException that is not a JacksonException and so escapes the parser contract. Either outcome crashes the request or processing thread. This is the same class of issue as CVE-2020-28491 in the CBOR parser of this library, which was fixed with a LONGEST_NON_CHUNKED_BINARY guard; the asynchronous Smile parser never received the equivalent guard. No privileges or user interaction beyond the ability to submit data for parsing are required.

Created: 2026-11-08 Last update: 2026-11-08 02:00

news

[2026-11-05] jackson-dataformat-smile REMOVED from testing (Debian testing watch)
[2026-11-04] Removed 2.7.8-6 from unstable (Debian FTP Masters)
[2026-06-11] Accepted jackson-dataformat-smile 2.7.8-5+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-11] Accepted jackson-dataformat-smile 2.7.8-5+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-11] jackson-dataformat-smile 2.7.8-6 MIGRATED to testing (Debian testing watch)
[2026-06-10] Accepted jackson-dataformat-smile 2.7.8-5+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-10] Accepted jackson-dataformat-smile 2.7.8-5+deb12u1 (source) into oldstable-security (Debian FTP Masters) (signed by: Markus Koschany)
[2026-06-08] Accepted jackson-dataformat-smile 2.7.8-3+deb11u1 (source) into oldoldstable-security (Markus Koschany)
[2026-06-06] Accepted jackson-dataformat-smile 2.7.8-6 (source) into unstable (Markus Koschany)
[2021-11-09] jackson-dataformat-smile 2.7.8-5 MIGRATED to testing (Debian testing watch)
[2021-11-04] Accepted jackson-dataformat-smile 2.7.8-5 (source) into unstable (Markus Koschany)
[2021-11-02] Accepted jackson-dataformat-smile 2.7.8-4 (source) into unstable (Markus Koschany)
[2018-02-01] jackson-dataformat-smile 2.7.8-3 MIGRATED to testing (Debian testing watch)
[2018-01-26] Accepted jackson-dataformat-smile 2.7.8-3 (source) into unstable (Markus Koschany)
[2017-10-19] jackson-dataformat-smile 2.7.8-2 MIGRATED to testing (Debian testing watch)
[2017-10-13] Accepted jackson-dataformat-smile 2.7.8-2 (source) into unstable (Markus Koschany)
[2016-12-31] jackson-dataformat-smile 2.7.8-1 MIGRATED to testing (Debian testing watch)
[2016-12-19] Accepted jackson-dataformat-smile 2.7.8-1 (source all) into unstable (Emmanuel Bourg)
[2016-04-14] jackson-dataformat-smile 2.7.3-1 MIGRATED to testing (Debian testing watch)
[2016-04-08] Accepted jackson-dataformat-smile 2.7.3-1 (source all) into unstable (Emmanuel Bourg)
[2014-10-05] jackson-dataformat-smile 2.4.2-1 MIGRATED to testing (Britney)
[2014-09-24] Accepted jackson-dataformat-smile 2.4.2-1 (source all) into unstable (Timo Aaltonen)
[2013-12-06] jackson-dataformat-smile 2.2.2-1 MIGRATED to testing (Debian testing watch)
[2013-09-03] Accepted jackson-dataformat-smile 2.2.2-1 (source all) (Wolodja Wentland) (signed by: Hilko Bengen)

bugs [bug history graph]

all: 0

links

homepage
buildd: logs
popcon
browse source code
other distros
security tracker

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.7.8-6

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing