Inefficient Algorithmic Complexity in CBOR2 - #VU162744
Published: November 9, 2026
Vulnerability identifier: #VU162744
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to exhaust CPU resources and block worker processes in applications that decode untrusted CBOR data using cbor2.
The vulnerability exists due to quadratic dictionary insertion time when cbor2 decodes maps containing distinct bignum keys with identical Python hash values. An unauthenticated remote attacker can submit a comparatively small crafted CBOR payload that occupies a worker for over 90 seconds, causing denial of service.
Affected software
CBOR2
Remediation
Install security update from vendor's website.
CBOR2 - update to 6.2.0