SB2026110980 - Double free in CBOR2
Published: November 9, 2026
Security Bulletin ID
SB2026110980
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
CWE-ID: CWE-415 - Double Free
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows an unauthenticated remote attacker to cause memory corruption and denial of service by crashing a Python process using cbor2.
The vulnerability exists due to a double reference decrement in cbor2's C decoder when rejecting a truncated definite-length text string with a declared length greater than 64 KiB. An unauthenticated remote attacker can supply crafted CBOR to an application using the native extension to trigger the faulty cleanup.
Remediation
Install update from vendor's website.