Uncontrolled Recursion in CBOR2 - CVE-2026-26209
Published: November 9, 2026
Vulnerability identifier: #VU162741
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-26209
CWE-ID: CWE-674
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote unauthenticated attacker to cause sustained denial of service in applications that use cbor2 to decode untrusted data and do not catch recursion errors.
The vulnerability exists due to uncontrolled recursion in cbor2's Python and C decoders when processing deeply nested CBOR containers without an independent nesting limit. A remote unauthenticated attacker can repeatedly submit small crafted payloads to exceed Python's recursion limit and terminate worker processes.
Affected software
CBOR2
How to mitigate CVE-2026-26209
Install security update from vendor's website.
CBOR2 - update to 5.9.0