CVE-2024-26134 CBOR2 decoder has potential buffer overflow
An attacker can crash a service using the cbor2 library by sending a specially crafted long CBOR object, causing a buffer overflow.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26134?
CVE-2024-26134 is a high-severity denial of service vulnerability in Fedoraproject Fedora, published on 19 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
Weakness: CWE-120
Which versions are affected by CVE-2024-26134?
3 open source packages ship an affected version, including cbor2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
cbor2 PyPI | From 5.5.1 | 5.6.2 |
cbor2 PyPI | From 5.5.1 | 5.6.2 |
cbor2 PyPI | From 5.5.1 | 5.6.2 |
Linux distribution packages (1)
python-cbor2 openSUSE:Tumbleweed | All versions | 5.6.5-2.1 |
Products include Agronholm Cbor2, Fedoraproject Fedora.
How do I fix CVE-2024-26134?
Upgrade cbor2 to 5.6.2 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2024-26134 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-26134 exists.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2024-26134, GHSA-375g-39jq-vq7m, PYSEC-2024-155, UBUNTU-CVE-2024-26134, openSUSE-SU-2025:14733-1.