CVE-2020-37280

CVSS 8.7 (high) · published 2026-10-12

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.

Weakness: CWE-789

Source: NVD CVE-2020-37280

References

• https://github.com/PelionIoT/cbor-sync
• https://github.com/PelionIoT/cbor-sync/issues/6
• https://github.com/PelionIoT/cbor-sync/pull/4
• https://www.vulncheck.com/advisories/cbor-sync-through-1.0.4-memory-exhaustion-via-unchecked-cbor-array-lengths

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.