CVE-2020-28491

Name of the Vulnerable Software and Affected Versions com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 0 through 2.11.4 com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 2.12.0-rc1 through 2.12.1

Description The issue is related to the allocation of unlimited memory in the com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package of the jackson-dataformats-binary library. This can be exploited by a remote attacker to cause a denial of service. The unchecked allocation of a byte buffer can cause a java.lang.OutOfMemoryError exception.

Recommendations For com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 0 through 2.11.4, update to version 2.11.4 or later. For com.fasterxml.jackson.dataformat:jackson-dataformat-cbor versions 2.12.0-rc1 through 2.12.1, update to version 2.12.1 or later. As a temporary workaround, consider restricting the allocation of byte buffers to prevent the java.lang.OutOfMemoryError exception.