CVE-2020-28491

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
n/a	com.fasterxml.jackson.dataformat:jackson-dataformat-cbor	< unspecified; >= unspecified, < 2.11.4; >= 2.12.0-rc1, < unspecified; >= unspecified, < 2.12.1

References

https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6Patch, Third Party Advisory
https://github.com/FasterXML/jackson-dataformats-binary/issues/186Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6Patch, Third Party Advisory
https://github.com/FasterXML/jackson-dataformats-binary/issues/186Issue Tracking, Patch, Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329Patch, Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Timeline

Published: Feb 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-284935.3This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator CVE-2020-284948.6This affects the package total.js before 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to CVE-2020-284957.3This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However t CVE-2020-284967.5This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function b CVE-2020-284986.8The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no CVE-2020-284999.8All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .CVE-2020-28508.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions tha CVE-2020-285005.3Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions CVE-2020-285017.5This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.CVE-2020-285028.1This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (CVE-2020-285039.8The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.CVE-2020-28517.8Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected