...

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -25,8 +25,9 @@ Active maintainers:
 #720: (smile) `SmileGenerator` int overflow in `maxLen` for very long Strings
   (>= 715,827,882 chars) causes `ArrayIndexOutOfBoundsException`
  (reported by Benjamin M)
-#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser
-#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser
+#725: (cbor) Ensure `maxNameLength` limit enforced for CBOR parser [CVE-2026-68495]
+ (reported by @tinyb0y)
+#726: (smile) Ensure `maxNameLength` limit enforced for Smile parser [CVE-2026-68496]
  (reported by @tinyb0y)
 #727: (cbor) `CBORParser.nextFieldName(SerializableString)` confuses 5-bit length
   marker 23 with 24 ("1-byte length suffix follows")