TI-2020-20044 CVE-2020-37280 · GHSA-fpg7-639f-4v49Memory exhaustion in cbor-sync via unchecked CBOR array lengthsPriority MEDIUM 44cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input.CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00538 · Published 2026-10-12 · No fix listed CWE-789