Denial of Service Vulnerability in cbor2 Library by Agronholm

CVE-2026-26209

What is CVE-2026-26209?

The cbor2 library, which provides encoding and decoding for the Concise Binary Object Representation (CBOR) format, is susceptible to a Denial of Service (DoS) attack. This occurs due to unchecked recursion during the decoding of deeply nested CBOR structures, allowing an attacker to inject maliciously crafted payloads that can lead to process crashes. Versions prior to 5.9.0 lack a robust depth limit for recursion, permitting an attacker to exploit this by sending attacks that create approximately 100,000 nested arrays, overwhelming the application’s stack resources. As a result, when the maximum recursion depth is reached, the process fails with a RecursionError, causing web application servers or task queues to terminate, leading to service unavailability. Version 5.9.0 addresses this vulnerability with a patch.

References