Is CVE-2020-37280 being exploited?

No public exploit is currently tracked.

How severe is CVE-2020-37280?

CVE-2020-37280 has a CVSS v3 severity of HIGH (7.5).

Back

CVE-2020-37280

Description

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory.