CBOR2 decoder has potential buffer overflow
Priority HIGH 72CWE-120Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-120 and the CVSS impact.
Summary
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01167 67th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed cbor2 (agronholm): 5.6.2cbor2 (PyPI): 5.6.2
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| agronholm | cbor2 | 5.5.1 to before 5.6.2 | 5.6.2 | Patch available | CNA |
| — | cbor2 (PyPI) | 5.5.1 to before 5.6.2 | 5.6.2 | Patch available | GHSA-375g-39jq-vq7m |
- cbor2 Vendoragronholm Affected 5.5.1 to before 5.6.2 Fixed in 5.6.2 Patch available CNA
- cbor2 (PyPI) Vendor— Affected 5.5.1 to before 5.6.2 Fixed in 5.6.2 Patch available GHSA-375g-39jq-vq7m
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:* | 5.5.1 to before 5.6.2 | Vulnerable | agronholm |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* | 40 | Vulnerable | Fedoraproject |
- cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:* Versions 5.5.1 to before 5.6.2 Vulnerable ·agronholm
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* Versions 40 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA cbor2 (agronholm) Fixed in 5.6.2
- Fix · GHSA-375g-39jq-vq7m cbor2 (PyPI) Fixed in 5.6.2 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2024-26134
- 2026-10-03 Alias added: GHSA-375g-39jq-vq7m
References
Other 11
- https://github.com/agronholm/cbor2/pull/204
- https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542
- https://github.com/agronholm/cbor2/releases/tag/5.6.2
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/
- https://github.com/agronholm/cbor2
- https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ
- https://lists.fedoraproject.org/archives/list/[email protected]/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY
More agronholm Cbor2 vulnerabilities
- TI-2026-21200 cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads CVSS 3.0HIGH 7.5
- TI-2025-39535 Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the… CVSS 3.1HIGH 7.5
- TI-2025-41712 CBORDecoder reuse can leak shareable values across decode calls CVSS 4.0MEDIUM 5.5
Sources
- CVE-2024-26134 · CVE Program
- CVE-2024-26134 · NVD
- FIRST EPSS
- GHSA-375g-39jq-vq7m · GitHub Advisory Database · CC BY 4.0
- CVE-2024-26134 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences