CVE-2020-37280

Received Received - Intake

CBOR Decode Resource Exhaustion in cbor-sync

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2020-37280

Affected Vendors & Products

Vendor	Product	Version / Range
PelionIoT	cbor-sync	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-789	The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.

Attack-Flow Graph

Executive Summary

cbor-sync through 1.0.4 has a resource exhaustion issue in CBOR.decode. It trusts declared array and map lengths without verifying remaining input. Attackers can send a small crafted CBOR payload with huge declared lengths, causing excessive CPU and memory usage.

Detection Guidance

This vulnerability can be detected by monitoring for unusually high CPU or memory usage during CBOR decoding operations. Check for processes using cbor-sync that consume excessive resources unexpectedly. No specific commands are provided in the context.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by consuming excessive system resources. It may crash applications, slow down systems, or cause service outages if exploited by remote attackers.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting system resources, which may impact availability requirements in GDPR and HIPAA. However, specific compliance impacts depend on system configuration and deployment context.

Mitigation Strategies

Immediately update cbor-sync to the latest version beyond 1.0.4. If updating is not possible, restrict network access to systems using cbor-sync or implement input validation to limit declared array and map lengths in CBOR payloads.

Hi! I’m here to help you understand CVE-2020-37280. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70