{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3acbor-sync_projectcbor-sync/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cbor-sync_project:cbor-sync:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2020-37280"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe cbor-sync library (all versions up to and including 1.0.4) contains a resource exhaustion vulnerability in the \u003ccode\u003eCBOR.decode\u003c/code\u003e function. The library trusts declared array and map lengths within CBOR-encoded data without verifying them against the actual remaining input size. A remote attacker can supply a small, maliciously crafted CBOR payload that specifies an extremely large array or map length. When parsed by the \u003ccode\u003eCBOR.decode\u003c/code\u003e function, this payload forces the application to attempt to allocate excessive memory or process billions of iterations. This behavior results in high CPU utilization and memory exhaustion, effectively causing a denial-of-service condition for the host process. This vulnerability is significant for any application that accepts untrusted CBOR input from network endpoints.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability results in a denial of service (DoS) for applications utilizing the affected cbor-sync library. By forcing the host process to exhaust CPU cycles and system memory, attackers can cause application crashes or non-responsiveness. This impacts services relying on CBOR for data exchange, potentially leading to widespread service unavailability if the library is used in critical API endpoints or backend message-processing components.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the update of all instances of the cbor-sync library to a version later than 1.0.4. If an immediate update is not feasible, implement strict input validation for all CBOR payloads before passing them to the \u003ccode\u003eCBOR.decode\u003c/code\u003e function, specifically by verifying that the length headers of arrays and maps align with the actual data present in the input buffer.\u003c/p\u003e\n","date_modified":"2026-10-13T00:30:50Z","date_published":"2026-10-13T00:30:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cbor-sync-dos/","summary":"The cbor-sync library through version 1.0.4 is vulnerable to resource exhaustion via a crafted CBOR payload that causes uncontrolled iteration, leading to potential denial of service.","title":"Resource Exhaustion Vulnerability in cbor-sync","url":"https://feed.craftedsignal.io/briefs/2026-10-cbor-sync-dos/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:cbor-Sync_project:cbor-Sync:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}