{"action":"Upgrade jackson-dataformats-binary to 2.22.4-1 or later.","affected":[{"fixed":"2.22.4-1","introduced":"0"}],"component":"jackson-dataformats-binary","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["2.22.4-1"],"id":"tcs_01M6CY48YP0WEBS86EBV482MAZ","modified_at":"2026-11-07T09:47:37.815070364Z","published_at":"2026-10-28T01:16:55.017Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-110747","https://security-tracker.debian.org/tracker/CVE-2026-110747"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-110747","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-110747"}],"summary":"ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks (_inputPtr + len) <= _inputEnd using signed arithmetic. For"}