Log in Start free

Vulnerability · Published Feb 19, 2024 · Assigned by GitHub_M

CVE-2024-26134CBOR2 decoder has potential buffer overflow

High 7.5

In plain English

A high-severity buffer overflow in cbor2 from agronholm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)1.2%top 32.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13cbor25.6.2-1DEBIAN-CVE-2024-26134
Debian:14cbor25.6.2-1DEBIAN-CVE-2024-26134
PyPIcbor25.6.2GHSA-375g-39jq-vq7m
PyPIcbor25.6.2PYSEC-2024-155
Ubuntu:22.04:LTScbor2no fix listedUBUNTU-CVE-2024-26134
Ubuntu:24.04:LTScbor2no fix listedUBUNTU-CVE-2024-26134
Ubuntu:25.10cbor2no fix listedUBUNTU-CVE-2024-26134
Ubuntu:26.04:LTScbor2no fix listedUBUNTU-CVE-2024-26134
Ubuntu:26.10cbor2no fix listedUBUNTU-CVE-2024-26134

Affected products (as reported)

VendorProductVersions
agronholm cbor2 >= 5.5.1, < 5.6.2

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References