CVE-2020-37280 in cbor-sync
요약
\~에 의해 MITRE • 2026. 10. 13.
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.