CVE-2026-26209: cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads
(updated )
- The
cbor2library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. - This vulnerability affects both the pure Python implementation and the C extension (
_cbor2). The C extension correctly uses Python’s C-API for recursion protection (Py_EnterRecursiveCall), but this mechanism is designed to prevent a stack overflow by raising aRecursionError. In some environments, this exception is not caught, thus causing the service process to terminate. - While the library handles moderate nesting, it lacks a configurable, data-driven depth limit independent of Python’s global recursion setting. An attacker can supply a crafted CBOR payload containing thousands of nested arrays (e.g.,
0x81). Whencbor2.loads()attempts to parse this, it hits the interpreter’s recursion limit, causing the call to raise aRecursionError. - By sending a stream of small (<100KB) malicious packets, an attacker can repeatedly crash worker processes faster than they can be restarted, resulting in a complete and sustained Denial of Service.
References
- github.com/advisories/GHSA-3c37-wwvx-h642
- github.com/agronholm/cbor2
- github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b
- github.com/agronholm/cbor2/pull/275
- github.com/agronholm/cbor2/releases/tag/5.9.0
- github.com/agronholm/cbor2/security/advisories/GHSA-3c37-wwvx-h642
- nvd.nist.gov/vuln/detail/CVE-2026-26209
Code Behaviors & Features
Detect and mitigate CVE-2026-26209 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →