CVE-2026-26209: cbor2 denial of service via uncontrolled recursion

CVE-2026-26209 · Severity: low · CVSS 3 · Published 2026-03-23

cbor2 is a Python library used to encode and decode CBOR (Concise Binary Object Representation) data, commonly used in IoT, WebAuthn, and inter-service communication. The library fails to properly limit recursion depth when parsing deeply nested CBOR structures, allowing an attacker to crash the application by sending a small malicious payload (under 100KB). This results in repeated service outages as worker processes are terminated faster than they can be restarted.

Technologies: cbor2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-26209 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-26209 being exploited in the wild.
How severe is CVE-2026-26209?
Low severity, with a CVSS score of 3, published 23 March 2026.
Which products and versions are affected?
cbor2 (PyPI) ECOSYSTEM:introduced=0,fixed=5.9.0.
Is there a fix for CVE-2026-26209?
Yes. cbor2 (PyPI): upgrade to 5.9.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-26209 attacked?
It is attacked over the network.
Am I affected by CVE-2026-26209?
Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cbor2 (PyPI): upgrade to 5.9.0 or later
    pip install "cbor2>=5.9.0"

Technical details

The vulnerability is an uncontrolled recursion issue (CWE-674) in the CBORDecoder class, specifically in the decode_array and decode_map methods. The decoder recursively calls itself for each nested element without enforcing a depth limit independent of Python's global recursion setting. An attacker can craft a CBOR payload containing deeply nested arrays (using the CBOR byte sequence 0x81 repeated thousands of times) that causes cbor2.loads() to exceed the interpreter's recursion limit and raise a RecursionError. The attack requires no authentication and is remotely exploitable over the network. Payloads smaller than 100KB are sufficient to reliably crash worker processes. The fix was released in version 5.9.0, which adds configurable depth-limiting mechanisms to the decoder.

Affected products

  • cbor2 Project cbor2 before 5.9.0 (all versions from 1.0.0 through 5.8.0)

Identifiers

  • CVE-2026-26209
  • GHSA-3c37-wwvx-h642
  • PYSEC-2026-2123

Timeline

  • 2026-03-23: disclosed
  • 2026-03-23: patched: Fixed in version 5.9.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.