cbor-sync vulnerabilities

CVEs whose affected-version data names the cbor-sync package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2020-37280High· 7.5

2w ago

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengt…

▾ TwilightPelionIoT · cbor-syncEPSS 0.54%via NVD