Executive brief
cbor2 is a Python library used to encode and decode CBOR (Concise Binary Object Representation) data, commonly used in IoT, WebAuthn, and inter-service communication. The library fails to properly limit recursion depth when parsing deeply nested CBOR structures, allowing an attacker to crash the application by sending a small malicious payload (under 100KB). This results in repeated service outages as worker processes are terminated faster than they can be restarted.
Technical details
The vulnerability is an uncontrolled recursion issue (CWE-674) in the CBORDecoder class, specifically in the decode_array and decode_map methods. The decoder recursively calls itself for each nested element without enforcing a depth limit independent of Python's global recursion setting. An attacker can craft a CBOR payload containing deeply nested arrays (using the CBOR byte sequence 0x81 repeated thousands of times) that causes cbor2.loads() to exceed the interpreter's recursion limit and raise a RecursionError. The attack requires no authentication and is remotely exploitable over the network. Payloads smaller than 100KB are sufficient to reliably crash worker processes. The fix was released in version 5.9.0, which adds configurable depth-limiting mechanisms to the decoder.
Affected products
- cbor2 Project cbor2 before 5.9.0 (all versions from 1.0.0 through 5.8.0)
Timeline
- 2026-03-23: disclosed
- 2026-03-23: patched: Fixed in version 5.9.0