...

Author: cowtowncoder

release-notes/VERSION

@@ -29,9 +29,10 @@ No changes since 3.2
 #720: (smile) `SmileGenerator` int overflow in `maxLen` for very long Strings
   (>= 715,827,882 chars) causes `ArrayIndexOutOfBoundsException`
  (reported by Benjamin M)
-#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser
-#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser
-  (reported by @tinyb0y)
+#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser [CVE-2026-68495]
+ (reported by @tinyb0y)
+#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser [CVE-2026-68496]
+ (reported by @tinyb0y)
 #727: (cbor) `CBORParser.nextName(SerializableString)` confuses 5-bit length
   marker 23 with 24 ("1-byte length suffix follows")
 #728: (cbor) `CBORParser.nextName(SerializableString)` consumes Object entry