PT-2024-21293 · Cbor2+1 · Cbor2+1

Miri64 · Published 2024-02-19 · Updated 2025-12-10 · CVE-2024-26134

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions cbor2 versions 5.5.1 through 5.6.2

Description The issue concerns a denial-of-service vulnerability in cbor2, which provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. An attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.

Recommendations For versions 5.5.1 through 5.6.2, update to version 5.6.2 or later, which contains a patch for this issue. As a temporary workaround, consider restricting the size of CBOR objects that can be parsed to prevent crashes.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2024-26134

GHSA-375G-39JQ-VQ7M

OPENSUSE-SU-2025:14733-1

OPENSUSE-SU-2025:20133-1

PYSEC-2024-155

SUSE-SU-2025:21168-1

SUSE-SU-2025_21168-1

Affected Products

Suse

Cbor2

References · 36

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26134.json · Exploit
• 🔥 https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m · Exploit
• https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:21168-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-26134 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-26134 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-26134 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-26134 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:20133-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-26134 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-26134 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-155 · Vendor Advisory