CVE-2020-36049 - Denial of Service Vulnerability

Severity: Medium2021-03-09

Security Advisories

Abstract before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.

The package is vulnerable to Denial of Service (DoS). The decodeString() function in index.js fails to parse large remote strings passed into the application for decoding due to unnecessary memory allocation leading to Uncontrolled Resource Consumption. A remote attacker with control over the input string being decoded by the library may craft a malicious string that would cause an application using the package to crash.

The Oxygen Content Fusion product incorporates the as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

ProductSeverityFixed Release Availability
Oxygen Content Fusion 3.0 and olderMedium Oxygen Content Fusion 4.0


Syncro Soft recommands users of Content Fusion 3.0 or older to upgrade to Oxygen Content Fusion 4.0.



Severity: High

CVSS Score: 7.5

The package third-party library used by Oxygen Content Fusion software product is an affected version mentioned in CVE-2020-36049 vulnerability description.

Starting with Oxygen Content Fusion 4.0, we have limited the maximum size of a package to 1MB.

Therefore, the Oxygen Content Fusion product is not impacted by CVE-2020-36049.

List of Security Advisories