HIGH
PelionIoT
CVE published 2026-10-12
CVE-2020-37280
A vulnerability in cbor-sync through 1.0.4 can lead to memory exhaustion via unchecked CBOR array lengths. Remote attackers can supply crafted CBOR payloads to drive excessive iterations, exhausting CPU and process memory. This issue arises from the CBOR.decode function trusting declared array and map lengths without checking remaining input, allowing tiny crafted payloads with huge lengths to cause billi [truncated]