I think that we can check the second byte as well to make sure, same way we do in SMILE (by not only checking the first byte), check here: https://github.com/FasterXML/jackson-dataformat-cbor/blob/master/src/main/java/com/fasterxml/jackson/dataformat/cbor/CBORParserBootstrapper.java#L112 for the logic