PT-2021-7974 · Fasterxml+2 · Jackson Dataformat Cbor+2

Cowtowncoder · CVE-2020-28491 · Published 2021-02-18 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 0 through 2.11.4 com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 2.12.0-rc1 through 2.12.1

Description The issue is related to the allocation of unlimited memory in the com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package of the jackson-dataformats-binary library. This can be exploited by a remote attacker to cause a denial of service. The unchecked allocation of a byte buffer can cause a java.lang.OutOfMemoryError exception.

Recommendations For com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 0 through 2.11.4, update to version 2.11.4 or later. For com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 2.12.0-rc1 through 2.12.1, update to version 2.12.1 or later. As a temporary workaround, consider restricting the allocation of byte buffers to prevent the java.lang.OutOfMemoryError exception.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2023-08464

CVE-2020-28491

GHSA-XMC8-26Q4-QJHX

OESA-2021-1140

OPENSUSE-SU-2022_1678-1

OPENSUSE-SU-2024:11582-1

RHSA-2021:3527

RHSA-2021:3528

RHSA-2021:3529

SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329

SUSE-SU-2022:1678-1

SUSE-SU-2022_1678-1

Affected Products

Debian

Suse

Jackson Dataformat Cbor

References · 31

• https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6 · Patch
• https://github.com/FasterXML/jackson-dataformats-binary/issues/186 · Patch
• https://security-tracker.debian.org/tracker/CVE-2020-28491 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-28491 · Security Note
• https://osv.dev/vulnerability/GHSA-xmc8-26q4-qjhx · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-28491 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1140 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-28491 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-28491 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-MAVEN-CVE-2020-28491 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-28491 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08464 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28491 · Vendor Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329 · Patch