Inefficient Algorithmic Complexity in CBOR2 - #VU165941
Published: November 11, 2026
Vulnerability identifier: #VU165941
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-407
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption in applications decoding untrusted CBOR.
The vulnerability exists due to inefficient algorithmic complexity in cbor2's decode_bytestring() and decode_string() functions when decoding indefinite-length strings with allow_indefinite=True, as repeated concatenation copies accumulated immutable data. A remote attacker can submit valid CBOR byte or text strings containing many tiny chunks to trigger quadratic copying and degrade application availability.
Affected software
CBOR2
Remediation
Install security update from vendor's website.
CBOR2 - update to 6.1.2