Merge branch '3.1' into 3.2

Author: cowtowncoder

release-notes/VERSION

@@ -64,10 +64,10 @@ No changes since 3.2.0
 #720: (smile) `SmileGenerator` int overflow in `maxLen` for very long Strings
   (>= 715,827,882 chars) causes `ArrayIndexOutOfBoundsException`
  (reported by Benjamin M)
-#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser
- (NOTE: 3.x also needed the check on the `nextNameMatch()` decoding path)
-#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser
-  (reported by @tinyb0y)
+#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser [CVE-2026-68495]
+ (reported by @tinyb0y)
+#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser [CVE-2026-68496]
+ (reported by @tinyb0y)
 #727: (cbor) `CBORParser.nextName(SerializableString)` confuses 5-bit length
   marker 23 with 24 ("1-byte length suffix follows")
 #728: (cbor) `CBORParser.nextName(SerializableString)` consumes Object entry

release-notes/VERSION-2.x

@@ -26,8 +26,9 @@ No changes since 2.22
   buffer reload
 #715: (protobuf) `ProtobufGenerator._reportWrongWireType()` always reports `string`,
   ignoring actual type
-#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser
-#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser
+#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser [CVE-2026-68495]
+ (reported by @tinyb0y)
+#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser [CVE-2026-68496]
  (reported by @tinyb0y)
 #727: (cbor) `CBORParser.nextFieldName(SerializableString)` confuses 5-bit length
   marker 23 with 24 ("1-byte length suffix follows")
@@ -59,8 +60,9 @@ No changes since 2.21
 #720: (smile) `SmileGenerator` int overflow in `maxLen` for very long Strings
   (>= 715,827,882 chars) causes `ArrayIndexOutOfBoundsException`
  (reported by Benjamin M)
-#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser
-#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser
+#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser [CVE-2026-68495]
+ (reported by @tinyb0y)
+#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser [CVE-2026-68496]
  (reported by @tinyb0y)
 #727: (cbor) `CBORParser.nextFieldName(SerializableString)` confuses 5-bit length
   marker 23 with 24 ("1-byte length suffix follows")
@@ -201,8 +203,9 @@ No changes since 2.19.1
 
 2.18.10 (not yet released)
 
-#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser
-#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser
+#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser [CVE-2026-68495]
+ (reported by @tinyb0y)
+#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser [CVE-2026-68496]
  (reported by @tinyb0y)
 #727: (cbor) `CBORParser.nextFieldName(SerializableString)` confuses 5-bit length
   marker 23 with 24 ("1-byte length suffix follows")