CVE-2020-37280 in cbor-sync
Sumário
de MITRE • 13/10/2026
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.