CVE-2020-36049 - Denial of Service Vulnerability

Severity: Medium2021-03-09

Security Advisories


Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.

The package is vulnerable to Denial of Service (DoS) attacks. The constructor in server.js declares an insecure buffer limit of 100mb for requests. A remote attacker can exploit this vulnerability by leveraging the long polling transport to submit a large POST payload that may encapsulate multiple malicious packets. Processing this payload will cause the application to consume all available resources, ultimately resulting in a DoS condition.

The Oxygen Content Fusion product incorporates the as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

ProductSeverityFixed Release Availability
Oxygen Content Fusion 3.0 and olderMedium Oxygen Content Fusion 4.0 build 2021030311


Syncro Soft recommands users of Content Fusion 3.0 or older to upgrade to Oxygen Content Fusion 4.0 or newer.



Severity: High

CVSS Score: 7.5

The package third-party library used by Oxygen Content Fusion software product is an affected version mentioned in CVE-2020-36048 vulnerability description.

Starting with Oxygen Content Fusion 4.0, we have limited the maximum size of a package to 1MB.

Therefore, the Oxygen Content Fusion product is not impacted by CVE-2020-36048.

Revision History

2022-10-13 Starting with Oxygen Content Fusion version 5.0 build 2022052605, the was updated to a non-vulnerable version.

List of Security Advisories