SB2026110977 - Multiple vulnerabilities in CBOR2

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: CVE-2026-26209)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote unauthenticated attacker to cause sustained denial of service in applications that use cbor2 to decode untrusted data and do not catch recursion errors.

The vulnerability exists due to uncontrolled recursion in cbor2's Python and C decoders when processing deeply nested CBOR containers without an independent nesting limit. A remote unauthenticated attacker can repeatedly submit small crafted payloads to exceed Python's recursion limit and terminate worker processes.

2) Memory leak (CVE-ID: N/A)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to cause denial of service through memory exhaustion in applications that decode untrusted CBOR data.

The vulnerability exists due to unreleased intermediate strings in the cbor2 C extension decoder when processing definite-length text strings larger than 64 KB. An unauthenticated remote attacker can submit a CBOR text string of about 5 MB to leave approximately 188 MB of memory allocated until process termination.

Remediation

Install update from vendor's website.

References

• https://github.com/agronholm/cbor2/security/advisories/GHSA-3c37-wwvx-h642
• https://github.com/agronholm/cbor2/security/advisories/GHSA-x2xm-p98v-j3v7