# CVE-2024-26134: CBOR2 buffer overflow in decoder

Source: https://junglewise.ai/threats/cve-2024-26134-cbor2-buffer-overflow-in-decoder  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-19. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2024-26134 · Severity: low · CVSS 3.1 · Published 2024-02-19

CBOR2 is a Python library for encoding and decoding CBOR (Concise Binary Object Representation) data, widely used for efficient serialization in IoT and other applications. An attacker who can send a maliciously crafted CBOR message with an oversized string payload can crash services that use this library, causing a denial of service.

Technologies: [cbor2 (PyPI)](https://junglewise.ai/threats/technologies/cbor2). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-26134 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-26134 being exploited in the wild.

**How severe is CVE-2024-26134?** Low severity, with a CVSS score of 3.1, published 19 February 2024.

**Which products and versions are affected?** cbor2 (PyPI) ECOSYSTEM:introduced=5.5.1,fixed=5.6.2, GIT:introduced=0,fixed=387755eacf0be35591a478d3c67fe10618a6d542,fixed=4de6991ba29bf2290d7b9d83525eda7d021873df|ECOSYSTEM:introduced=5.5.1,fixed=5.6.2.

**Is there a fix for CVE-2024-26134?** Yes. cbor2 (PyPI): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-26134 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-26134?** Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- cbor2 (PyPI): upgrade to 5.6.2 or later

  ```sh
  pip install "cbor2>=5.6.2"
  ```


## Technical details

A buffer overflow vulnerability exists in the CBOR2 decoder introduced in version 5.5.1 following PR #204. The vulnerability occurs when decoding CBOR-encoded strings longer than 131,128 characters, causing the decoder to write beyond allocated buffer boundaries. The vulnerability is triggered by calling cbor2.loads() on a maliciously crafted CBOR binary; the crash manifests as "malloc(): unsorted double linked list corrupted" on resource-constrained systems and SystemError on others. The attack requires network reachability to a service parsing untrusted CBOR data and no authentication. The fix is available in version 5.6.2.

## Affected products

- agronholm CBOR2 5.5.1, 5.6.0, 5.6.1

## Identifiers

- CVE-2024-26134
- GHSA-375g-39jq-vq7m
- PYSEC-2024-155

## Timeline

- 2024-02-19: disclosed: CVE-2024-26134 published
- 2024-02-21: advisory: GHSA-375g-39jq-vq7m published
- 2024-02-21: patched: Version 5.6.2 released with fix

## References

- [https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m](https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m)

## Related threats

- [cbor2 denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-26209-cbor2-denial-of-service-via-uncontrolled-recursion)
- [agronholm cbor2 information disclosure via decoder reuse](https://junglewise.ai/threats/cve-2025-68131-agronholm-cbor2-information-disclosure-via-decoder-reuse)
- [cbor2 C extension integer underflow and memory leak in decoder](https://junglewise.ai/threats/cve-2025-64076-cbor2-c-extension-integer-underflow-and-memory-leak-in-decoder)