Memory leak in CBOR2 - #VU162742
Published: November 9, 2026
Vulnerability identifier: #VU162742
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause denial of service through memory exhaustion in applications that decode untrusted CBOR data.
The vulnerability exists due to unreleased intermediate strings in the cbor2 C extension decoder when processing definite-length text strings larger than 64 KB. An unauthenticated remote attacker can submit a CBOR text string of about 5 MB to leave approximately 188 MB of memory allocated until process termination.
Affected software
CBOR2
Remediation
Install security update from vendor's website.
CBOR2 - update to 5.9.0