SB2026110978 - Multiple vulnerabilities in CBOR2

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Recursion (CVE-ID: N/A)

CWE-ID: CWE-674 - Uncontrolled Recursion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote unauthenticated attacker to crash services that decode untrusted CBOR using the cbor2 native extension.

The vulnerability exists due to shared-reference tags bypassing the max_depth guard in cbor2.loads(), permitting deeply nested map keys that trigger uncontrolled native recursion during hashing. A remote unauthenticated attacker can submit a crafted CBOR message to cause an uncatchable stack overflow that terminates the decoding process.

2) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and block worker processes in applications that decode untrusted CBOR data using cbor2.

The vulnerability exists due to quadratic dictionary insertion time when cbor2 decodes maps containing distinct bignum keys with identical Python hash values. An unauthenticated remote attacker can submit a comparatively small crafted CBOR payload that occupies a worker for over 90 seconds, causing denial of service.

Remediation

Install update from vendor's website.

References

• https://github.com/agronholm/cbor2/security/advisories/GHSA-55vx-2phh-7grr
• https://github.com/agronholm/cbor2/security/advisories/GHSA-p6xp-9h6j-r278