Double free in CBOR2 - #VU162746
Published: November 9, 2026
Vulnerability identifier: #VU162746
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-415
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to cause memory corruption and denial of service by crashing a Python process using cbor2.
The vulnerability exists due to a double reference decrement in cbor2's C decoder when rejecting a truncated definite-length text string with a declared length greater than 64 KiB. An unauthenticated remote attacker can supply crafted CBOR to an application using the native extension to trigger the faulty cleanup.
Affected software
CBOR2
Remediation
Install security update from vendor's website.
CBOR2 - update to 6.0.0