Description
cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.
Published: 2026-10-12
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Resource Exhaustion
Action: Immediate Patch
AI Analysis

Impact

The flaw resides in the CBOR.decode routine, which accepts array and map lengths specified in a CBOR payload without validating that the lengths match the remaining data. An attacker can construct a minimal CBOR payload that declares extraordinarily large lengths, causing the decoder to iterate billions of times and allocate huge buffers, leading to CPU exhaustion and out‑of‑memory termination of the process. The weakness is classified as CWE‑789, an improper size validation that enables resource exhaustion.

Affected Systems

PelionIoT cbor-sync, all versions up to and including 1.0.4 are vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 8.7, indicating high severity. EPSS data is unavailable, but the flaw is suitable for remote exploitation: a malicious actor can send the crafted CBOR payload over any interface where the library is used to deserialize data. The attack does not require elevated privileges on the target system; it can be executed against any process that uses the vulnerable library. The vulnerability is not currently listed in CISA KEV, but its high severity and remote nature merit prompt remediation.

Generated by OpenCVE AI on October 12, 2026 at 22:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest cbor-sync release (≥1.0.5) that enforces length checks on CBOR arrays and maps
  • If upgrading is not immediately possible, implement an input validation layer that verifies claimed lengths against remaining data before calling CBOR.decode
  • Add resource limits or rate‑limiting to any service that accepts external CBOR data to mitigate the impact of a successful denial‑of‑service attack

Generated by OpenCVE AI on October 12, 2026 at 22:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
First Time appeared Pelioniot
Pelioniot cbor-sync
Vendors & Products Pelioniot
Pelioniot cbor-sync

Mon, 12 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.
Title cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths
Weaknesses CWE-789
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Pelioniot Cbor-sync
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T16:52:41.604Z

Reserved: 2026-10-12T19:27:44.866Z

Link: CVE-2020-37280

cve-icon Vulnrichment

Updated: 2026-10-13T16:22:07.439Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T21:17:05.733

Modified: 2026-10-16T19:18:44.867

Link: CVE-2020-37280

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:25:32Z

Weaknesses
  • CWE-789

    Memory Allocation with Excessive Size Value