CVE-2020-28491

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

• CWE-770

• https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6Patch, Third Party Advisory
• https://github.com/FasterXML/jackson-dataformats-binary/issues/186Issue Tracking, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329Patch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6Patch, Third Party Advisory
• https://github.com/FasterXML/jackson-dataformats-binary/issues/186Issue Tracking, Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329Patch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Feb 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-28482This affects the package fastify-csrf before 3.0.0. 1. The g…8.8
• CVE-2020-28483This affects all versions of package github.com/gin-gonic/gi…7.1
• CVE-2020-28487This affects the package vis-timeline before 7.4.4. An attac…6.8
• CVE-2020-28488Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-2849Vulnerability in the Oracle Depot Repair product of Oracle E…8.2
• CVE-2020-28490The package async-git before 1.13.2 are vulnerable to Comman…9.8
• CVE-2020-28492Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-28493This affects the package jinja2 from 0.0.0 and before 2.11.3…5.3
• CVE-2020-28494This affects the package total.js before 3.4.7. The issue oc…8.6
• CVE-2020-28495This affects the package total.js before 3.4.7. The set func…7.3
• CVE-2020-28496This affects the package three before 0.125.0. This can happ…7.5
• CVE-2020-28498The package elliptic before 6.5.4 are vulnerable to Cryptogr…6.8