Executive brief
CBOR2 is a Python library for encoding and decoding CBOR (Concise Binary Object Representation) data, widely used for efficient serialization in IoT and other applications. An attacker who can send a maliciously crafted CBOR message with an oversized string payload can crash services that use this library, causing a denial of service.
Technical details
A buffer overflow vulnerability exists in the CBOR2 decoder introduced in version 5.5.1 following PR #204. The vulnerability occurs when decoding CBOR-encoded strings longer than 131,128 characters, causing the decoder to write beyond allocated buffer boundaries. The vulnerability is triggered by calling cbor2.loads() on a maliciously crafted CBOR binary; the crash manifests as "malloc(): unsorted double linked list corrupted" on resource-constrained systems and SystemError on others. The attack requires network reachability to a service parsing untrusted CBOR data and no authentication. The fix is available in version 5.6.2.
Affected products
- agronholm CBOR2 5.5.1, 5.6.0, 5.6.1
Timeline
- 2024-02-19: disclosed: CVE-2024-26134 published
- 2024-02-21: advisory: GHSA-375g-39jq-vq7m published
- 2024-02-21: patched: Version 5.6.2 released with fix