CVE-2024-26134CWE-120

CBOR2 decoder has potential buffer overflow

High · published February 19, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
67.3
In the wild
Unconfirmed
What it is

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01177 · 67.3th percentile
Weakness
CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2024-02-19T22:13Z
EPSS history
Timeline
  • 19 FEB 22:13Z
    CBOR2 decoder has potential buffer overflow
    cvelistv5