What’s Vulnerable › Vulnerabilities

CVE-2020-28491: Denial of Service (DoS)

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-18 · updated 2026-06-17
• Weakness: CWE-770

Description

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

Affected products

• FasterXML jackson-dataformats-binary: before 2.11.4; from 2.12.0 (excl.) before 2.12.1; 2.12.0, 2.12.0-rc1, 2.12.0-rc2 — fixed in 2.11.4, 2.12.1
• Oracle WebLogic Server: 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
• quarkusio quarkus: before 2.0.2 — fixed in 2.0.2

How to fix

Upgrade to a fixed version: FasterXML jackson-dataformats-binary 2.11.4, 2.12.1; quarkusio quarkus 2.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6
• https://github.com/FasterXML/jackson-dataformats-binary/issues/186
• https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6
• https://github.com/FasterXML/jackson-dataformats-binary/issues/186
• https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2020-28491 or the next vulnerability affects your stack