wolfCOSE

wolfCOSE wolfCOSE is a lightweight and fast C library implementing core CBOR and COSE standards, backed by wolfSSL for cryptography. Supported Standards & RFCs Core Specifications: RFC 8949 - Concise Binary Object Representation CBOR RFC 9052 - CBOR Object Signing and Encryption COSE RFC 9053 -...

CVE-2026-107157

A flaw was found in Qt. An out-of-bounds read vulnerability exists in the QCborValue::fromCbor function when parsing malformed Concise Binary Object Representation CBOR data. By convincing an application to process specially crafted CBOR input, an attacker could cause an application crash leading...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libwebsockets (UTSA-2026-142313)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-142313 advisory. A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function reportrawcbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. Th...

CLEANSTART-2026-OQ29524 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

CVE-2026-68495 affects multiple packages. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints. See references for individual vulnerability details...

CLEANSTART-2026-AR08566 CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints

Security vulnerability affects the solr package. The CBOR parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

EUVD-2020-31277

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280

The cbor-sync library, versions through 1.0.4 , is vulnerable to a resource exhaustion attack within the CBOR.decode function. The root cause is that the component trusts declared array and map lengths without verifying the remaining input. An attacker can provide a small, crafted CBOR payload wi...

CVE-2020-37280 cbor-sync through 1.0.4 Memory Exhaustion via Unchecked CBOR Array Lengths

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

CVE-2020-37280: Memory Allocation with Excessive Size Value

cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and proce...

RHLW-2026-56415B28EA79906A Lightwell Security Advisory: jackson-dataformat-cbor 2.9.10.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.9.10.rhlw-00001 with a backported security fix. CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1...

RHLW-2026-2324B17F545E0135 Lightwell Security Advisory: jackson-dataformat-cbor 2.10.0.rhlw-00001

Red Hat Lightwell has released com.fasterxml.jackson.dataformat:jackson-dataformat-cbor 2.10.0.rhlw-00001 with a backported security fix. CVE-2020-28491: This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1...

CVE-2026-106447

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor decoder recursively processes nested CBOR arrays, maps, and tags through decodeValue without enforcing a maximum nesting depth. A sufficiently deep structure exhausts the JavaScript call...

CVE-2026-106448

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

CVE-2026-106448

The @stablelib/cbor component within the StableLib library is vulnerable to prototype poisoning (CWE-1321) in versions prior to 2.0.4 . The root cause lies in the CBOR map decoding path, where the library creates ordinary JavaScript objects and uses bracket assignment for attacker-controlled keys...

CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

EUVD-2026-93973

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...

CVE-2026-106448 StableLib: Prototype poisoning via `__proto__` map keys in CBOR decoding

StableLib is a stable library of useful TypeScript and JavaScript code. Prior to 2.0.4, the @stablelib/cbor CBOR map decoding path creates ordinary JavaScript objects and assigns attacker-controlled keys with bracket assignment. A map key named proto invokes the inherited prototype setter instead...