{"id":"CVE-2026-26209","summary":"cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads","details":"cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError` and crashes the worker process when the limit is hit. While the library handles moderate nesting levels, it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python interpreter's maximum recursion depth or exhausts the stack, causing the process to crash with a `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to exhaust the host application's stack resource. In many web application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery), an unhandled `RecursionError` terminates the worker process immediately. By sending a stream of these small (\u003c100KB) malicious packets, an attacker can repeatedly crash worker processes, resulting in a complete Denial of Service for the application. Version 5.9.0 patches the issue.","aliases":["GHSA-3c37-wwvx-h642","PYSEC-2026-2123"],"modified":"2026-08-12T16:24:54.751692Z","published":"2026-03-23T18:53:10.268Z","related":["CGA-pxg7-m349-gccx","SUSE-SU-2026:21139-1","openSUSE-SU-2026:10425-1","openSUSE-SU-2026:20468-1"],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-674"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26209.json"},"references":[{"type":"WEB","url":"https://github.com/agronholm/cbor2/releases/tag/5.9.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26209.json"},{"type":"ADVISORY","url":"https://github.com/agronholm/cbor2/security/advisories/GHSA-3c37-wwvx-h642"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-26209"},{"type":"FIX","url":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b"},{"type":"FIX","url":"https://github.com/agronholm/cbor2/pull/275"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/agronholm/cbor2","events":[{"introduced":"0"},{"fixed":"93c598838d50b554e242920902aada82d32d55bc"},{"fixed":"e61a5f365ba610d5907a0ae1bc72769bba34294b"}],"database_specific":{"cpe":"cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:*","extracted_events":[{"introduced":"0"},{"fixed":"5.9.0"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["5.8.0","5.7.1","5.7.0","5.6.5","5.6.4","5.6.3","5.6.2","5.6.1","5.6.0","5.5.1","5.5.0","5.4.6","5.4.5","5.4.4","5.4.3","5.4.2.post1","5.2.0","5.4.2","5.4.1","5.4.0","5.3.0","5.1.2","5.1.1","5.1.0","5.0.1","5.0.0","4.2.0","4.1.2","4.1.1","4.1.0","4.0.1","4.0.0","3.0.4","3.0.3","3.0.2","3.0.1","3.0.0","2.0.0","1.1.0","1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-26209.json","vanir_signatures_modified":"2026-08-12T16:24:54Z","vanir_signatures":[{"id":"CVE-2026-26209-09cb250f","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"function":"CBORDecoder_read","file":"source/decoder.c"},"deprecated":false,"digest":{"function_hash":"226455796858828147857459139332635788724","length":309}},{"digest":{"line_hashes":["336224913408382115017086922156309531310","8341263667257301340641223391238399266","4423661848346981254955319156569360755","286922258479331763544086095454388926109","31467493630780852026139425327988739388","32264871655236044000843099846474198618","302970518168936065090577559463029136666","222785958633576150474027363861570677536"],"threshold":0.9},"id":"CVE-2026-26209-0a5e22a6","signature_type":"Line","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.h"},"deprecated":false},{"id":"CVE-2026-26209-43cf9751","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"CBORDecoder_decode_float32"},"deprecated":false,"digest":{"function_hash":"127965596936591779847631414755316918291","length":305}},{"digest":{"function_hash":"249008456050462054560887989553930611237","length":244},"id":"CVE-2026-26209-498a997d","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"fp_read_object"},"deprecated":false},{"source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"decode_indefinite_strings"},"deprecated":false,"digest":{"function_hash":"197635271597199485763448729339477096518","length":657},"id":"CVE-2026-26209-646b1da3","signature_type":"Function","signature_version":"v1"},{"target":{"file":"source/decoder.c"},"deprecated":false,"digest":{"line_hashes":["291908513702261396308291114673082484822","211645011143470496505222398862770672443","331302487787405787596545484490445653247","311099188034805997488960768441113039549","48694454319898822433759663838952917299","330615049569083627080054247925059294838","37531839830128133886296501397622436401","43923500621174410070734160635301825932","192916263770275738113213970844631633774","68775961654605704740177844063387718578","55764877734956143606383653094977704642","137825198262452558435631419581757127172","308841870382585245941512860533999842908","300064883230220692714509732535903494550","45132403466886080297231995610087561539","33186711653788486252046818679540051174","54677470372079517958833399649355158769","504820332279144053925507387799332500","40871188566960555797534865343993917120","94211501627486877210843075656790948714","38263156594959892948364598126274855921","295595637029948756081875806440024716582","152307983649719145326605098450564750449","124654100602779921361224721642781118832","139768698563316615760702152692335007176","111756771132469500401525112333906869422","62554319529409249679257087454854882671","103144054680886695394678650920629308866","239267440032703934204935828050429321176","75959693764763507684173812066877846504","44859500491413927783246215662236902686","55861845705435956158057896960444788449","218818673362079346848558939761768024469","136607729321675244777742659793517739118","68995291782954411350611529811498354604","275747062010484380931876989244681062366","222730244808107269675790349812220165238","55822407745752232559791869858892090011","289938053365273908978280526941942681959","295214341586931372599874266867119599214","297019175244084130909160443797329956503","250007120690754791149961412360292213627","105905629958682743954520810600367922910","70045606651886657545615138148379122886","180281868808969482480270576534574601865","321128907855512631509755046779162893935","289810846435805429085663576346140294972","217800558863358337849533994353867405597","243633173274839511182857094553982749718","285331927973394950173669567706316181220","760175898698330065197265830499436353","282672507277651011910824856949015141221","243633173274839511182857094553982749718","285331927973394950173669567706316181220","79417173907428266528853683106701401324","305794849861373488024877912313826477832","326180349026898730994654338074591394824","150392205626848521614391667010493232190","81512301100793144376210480165960123653","136250063374922017025700516418905581987","5642273172660015604424037239006168490","106549344252570987530423305083282059781","335250586077510142791760001083324013001","267688552876353146261153458175179910661","209906407063576202457981422095284176726","215073072656199972742174110211972327718","155574655191848846275969183306023395848","121563304907340643945421402135341127789","177071767234293566057852155124560512717","245482785477629359871229149419604969459","165293574149851582048231496760592474564","262018051943496158346236091714500846890","299000831133333908128009769983589081517","127855773215975823182374309796752240130","26901536706706561247444149889450950005","51550995844862948822031814752467073044","268660661150957543794051577942219343648","239523003602965415787565229119235219048","26320041881042665535150844701864068500"],"threshold":0.9},"id":"CVE-2026-26209-66706986","signature_type":"Line","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b"},{"signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"function":"CBORDecoder_decode_float64","file":"source/decoder.c"},"deprecated":false,"digest":{"function_hash":"145691782647669317982785999383927695188","length":308},"id":"CVE-2026-26209-6bfd41dd","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"288970317486581079630068306987437211372","length":919},"id":"CVE-2026-26209-773e02ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"fp_read"}},{"target":{"file":"source/decoder.c","function":"CBORDecoder_decode_float16"},"deprecated":false,"digest":{"function_hash":"129664359911039921624538315878111197244","length":277},"id":"CVE-2026-26209-9479c69e","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b"},{"source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"decode_indefinite_bytestrings"},"deprecated":false,"digest":{"function_hash":"38387971764029404404619323248890561242","length":667},"id":"CVE-2026-26209-a2a12cd8","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"51748355127600037201799551640534044134","length":800},"id":"CVE-2026-26209-ad174ae2","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"_CBORDecoder_set_fp_with_read_size"}},{"signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"CBORDecoder_new"},"deprecated":false,"digest":{"function_hash":"166951733082817850458574699859590040065","length":788},"id":"CVE-2026-26209-b1603e7c","signature_type":"Function"},{"target":{"function":"CBORDecoder_decode_simple_value","file":"source/decoder.c"},"deprecated":false,"digest":{"function_hash":"55911130201944682519303792157290883856","length":355},"id":"CVE-2026-26209-bda2b1ae","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b"},{"digest":{"function_hash":"69620336377617947895123103265014118326","length":1214},"id":"CVE-2026-26209-f396eb6d","signature_type":"Function","signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"decode_length"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b","target":{"file":"source/decoder.c","function":"decode"},"deprecated":false,"digest":{"function_hash":"157219205468573564837611333332268885248","length":1090},"id":"CVE-2026-26209-f626363d","signature_type":"Function"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}