{"action":"Upgrade com.fasterxml.jackson.dataformat:jackson-dataformat-cbor to 2.11.4 (2.11.x) or 2.12.1 (2.12.x) or later.","affected":[{"fixed":"2.11.4","introduced":"2.8.0rc1"},{"fixed":"2.12.1","introduced":"2.12.0rc1"}],"component":"com.fasterxml.jackson.dataformat:jackson-dataformat-cbor","cve_ids":["CVE-2020-28491"],"ecosystem":"Maven","exploited":false,"fixed_versions":["2.11.4","2.12.1"],"ghsa_id":"GHSA-xmc8-26q4-qjhx","id":"tcs_01M5N9JKPFPWGP38KB7X85V7AX","modified_at":"2026-09-10T03:49:10.563718199Z","published_at":"2021-12-09T19:17:21Z","references":["https://osv.dev/vulnerability/GHSA-xmc8-26q4-qjhx","https://nvd.nist.gov/vuln/detail/CVE-2020-28491","https://github.com/FasterXML/jackson-dataformats-binary/issues/186","https://github.com/FasterXML/jackson-dataformats-binary/commit/3d7de83423f8f68f8e9a0c8250084e11818544c7","https://github.com/FasterXML/jackson-dataformats-binary/commit/de072d314af8f5f269c8abec6930652af67bc8e6","https://github.com/FasterXML/jackson-dataformats-binary","https://snyk.io/vuln/SNYK-JAVA-COMFASTERXMLJACKSONDATAFORMAT-1047329","https://www.oracle.com/security-alerts/cpujul2022.html"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-xmc8-26q4-qjhx","url":"https://osv.dev/vulnerability/GHSA-xmc8-26q4-qjhx"}],"summary":"Denial of Service (DoS) in Jackson Dataformat CBOR"}