Read the docs
TI-2020-17296 Aliases CVE-2020-28491GHSA-xmc8-26q4-qjhx

Denial of service (DoS) in com.fasterxml.jackson.dataformat:jackson-dataformat-cbor

Priority LOW 37CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 14 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.

Why it matters now

EPSS 0.02417 84th percentileScored 2026-11-07
Fix Partial com.fasterxml.jackson.dataformat:jackson-dataformat-cbor: 2.11.4, 2.12.1com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (Maven): 2.11.4, 2.12.1Red Hat: 14 advisoriesRed Hat: 14 fixed, 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—com.fasterxml.jackson.dataformat:jackson-dataformat-cborall versions; before 2.11.4; 2.12.0-rc1 and later; before 2.12.12.11.4, 2.12.1Patch availableCNA
—com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (Maven)2.8.0rc1 to before 2.11.42.11.4Patch availableGHSA-xmc8-26q4-qjhx
—com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (Maven)2.12.0rc1 to before 2.12.12.12.1Patch availableGHSA-xmc8-26q4-qjhx
  • com.fasterxml.jackson.dataformat:jackson-dataformat-cbor Vendor— Affected all versions; before 2.11.4; 2.12.0-rc1 and later; before 2.12.1 Fixed in 2.11.4, 2.12.1 Patch available CNA
  • com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (Maven) Vendor— Affected 2.8.0rc1 to before 2.11.4 Fixed in 2.11.4 Patch available GHSA-xmc8-26q4-qjhx
  • com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (Maven) Vendor— Affected 2.12.0rc1 to before 2.12.1 Fixed in 2.12.1 Patch available GHSA-xmc8-26q4-qjhx

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:fasterxml:jackson-dataformats-binary:*:*:*:*:*:*:*:*before 2.11.4; after 2.12.0, before 2.12.1VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-dataformats-binary:2.12.0:-:*:*:*:*:*:*2.12.0VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-dataformats-binary:2.12.0:rc1:*:*:*:*:*:*2.12.0 rc1VulnerableFasterXML
cpe:2.3:a:fasterxml:jackson-dataformats-binary:2.12.0:rc2:*:*:*:*:*:*2.12.0 rc2VulnerableFasterXML
cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:*before 2.0.2Vulnerablequarkusio
cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*12.2.1.3.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*12.2.1.4.0VulnerableOracle
cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*14.1.1.0.0VulnerableOracle
  • cpe:2.3:a:fasterxml:jackson-dataformats-binary:*:*:*:*:*:*:*:* Versions before 2.11.4; after 2.12.0, before 2.12.1 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-dataformats-binary:2.12.0:-:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-dataformats-binary:2.12.0:rc1:*:*:*:*:*:* Versions 2.12.0 rc1 Vulnerable ·FasterXML
  • cpe:2.3:a:fasterxml:jackson-dataformats-binary:2.12.0:rc2:*:*:*:*:*:* Versions 2.12.0 rc2 Vulnerable ·FasterXML
  • cpe:2.3:a:quarkus:quarkus:*:*:*:*:*:*:*:* Versions before 2.0.2 Vulnerable ·quarkusio
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:* Versions 12.2.1.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:* Versions 14.1.1.0.0 Vulnerable ·Oracle

Remediation

  • Fix · CNA com.fasterxml.jackson.dataformat:jackson-dataformat-cbor Fixed in 2.11.4, 2.12.1
  • Fix · GHSA-xmc8-26q4-qjhx com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (Maven) Fixed in 2.11.4 Advisory →
  • Fix · GHSA-xmc8-26q4-qjhx com.fasterxml.jackson.dataformat:jackson-dataformat-cbor (Maven) Fixed in 2.12.1 Advisory →

Red Hat 14 advisories

  • RHSA-2022:0728 Released 2022-03-02 · Red Hat rating Moderate
    OpenShift Logging bug fix and security update (5.2.8)
    • OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8
  • RHSA-2022:0727 Released 2022-03-01 · Red Hat rating Moderate
    OpenShift Logging bug fix and security update (5.1.9)
    • OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8
  • RHSA-2022:0721 Released 2022-03-01 · Red Hat rating Moderate
    OpenShift Logging bug fix and security update (5.3.5)
    • OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8
Show 11 more Red Hat advisories
  • RHSA-2022:0297 Released 2022-01-26 · Red Hat rating Moderate
    Red Hat Decision Manager 7.12.0 security update
    • RHDM 7.12.0
  • RHSA-2022:0296 Released 2022-01-26 · Red Hat rating Critical
    Red Hat Process Automation Manager 7.12.0 security update
    • RHPAM 7.12.0
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:4918 Released 2021-12-02 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.6 release and security update
    • Red Hat Integration
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2021:3880 Released 2021-10-20 · Red Hat rating Moderate
    Red Hat build of Quarkus 2.2.3 release and security update
    • Red Hat build of Quarkus 2.2.3
  • RHSA-2021:3534 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update
    • Red Hat Single Sign-On 7.4.9
  • RHSA-2021:3527 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update on RHEL 6
    • Red Hat Single Sign-On 7.4 for RHEL 6 Server rh-sso7-keycloak-9.0.15-1.redhat_00002.1.el6sso, rh-sso7-keycloak-server-9.0.15-1.redhat_00002.1.el6sso
  • RHSA-2021:3529 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update on RHEL 8
    • Red Hat Single Sign-On 7.4 for RHEL 8 rh-sso7-keycloak-9.0.15-1.redhat_00002.1.el8sso, rh-sso7-keycloak-server-9.0.15-1.redhat_00002.1.el8sso
  • RHSA-2021:3528 Released 2021-09-14 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.4.9 security update on RHEL 7
    • Red Hat Single Sign-On 7.4 for RHEL 7 Server rh-sso7-keycloak-9.0.15-1.redhat_00002.1.el7sso, rh-sso7-keycloak-server-9.0.15-1.redhat_00002.1.el7sso
  • RHSA-2021:3125 Released 2021-08-18 · Red Hat rating Moderate
    Red Hat build of Eclipse Vert.x 4.1.2 security update
    • vertx 4.1.2

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
OpenShift Logging 5.1Fixed RHSA-2022:0727
OpenShift Logging 5.2Fixed RHSA-2022:0728
OpenShift Logging 5.3Fixed RHSA-2022:0721
RHDM 7.12.0Fixed RHSA-2022:0297
RHPAM 7.12.0Fixed RHSA-2022:0296
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat IntegrationFixed RHSA-2021:4918
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat Single Sign-On 7.4 for RHEL 6 ServerFixed RHSA-2021:3527
Red Hat Single Sign-On 7.4 for RHEL 7 ServerFixed RHSA-2021:3528
Red Hat Single Sign-On 7.4 for RHEL 8Fixed RHSA-2021:3529
Red Hat Single Sign-On 7.4.9Fixed RHSA-2021:3534
Red Hat build of Quarkus 2.2.3Fixed RHSA-2021:3880
vertx 4.1.2Fixed RHSA-2021:3125
Not affected: 3 products
  • OpenShift Logging 5.1
  • OpenShift Logging 5.2
  • OpenShift Logging 5.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-28491
  2. 2026-10-03 Alias added: GHSA-xmc8-26q4-qjhx

References

Patch 3

Advisory 1

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences