« Volver al listado

CVE-2026-26209

Estado: AnalizadaAlta (7.5)—

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError` and crashes the worker process when the limit is hit.

Leer descripción completaMostrar menos

While the library handles moderate nesting levels, it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python interpreter's maximum recursion depth or exhausts the stack, causing the process to crash with a `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to exhaust the host application's stack resource. In many web application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery), an unhandled `RecursionError` terminates the worker process immediately. By sending a stream of these small (<100KB) malicious packets, an attacker can repeatedly crash worker processes, resulting in a complete Denial of Service for the application. Version 5.9.0 patches the issue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota sin autenticación (AV:N/PR:N/UI:N) en cbor2 que permite DoS por agotamiento de recursos de stack (recursión no controlada), explotable enviando payloads CBOR malformados pequeños (<100KB) que causen crash de procesos worker.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (1)

Agronholm — Cbor2

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-26209",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-26209",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-24T18:35:22.617238Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "agronholm",
          "product": "cbor2",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.9.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-23T19:16:39.530",
  "references": [
    {
      "url": "https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b",
      "tags": [
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/agronholm/cbor2/pull/275",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/agronholm/cbor2/releases/tag/5.9.0",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-3c37-wwvx-h642",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError` and crashes the worker process when the limit is hit. While the library handles moderate nesting levels, it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python interpreter's maximum recursion depth or exhausts the stack, causing the process to crash with a `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to exhaust the host application's stack resource. In many web application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery), an unhandled `RecursionError` terminates the worker process immediately. By sending a stream of these small (<100KB) malicious packets, an attacker can repeatedly crash worker processes, resulting in a complete Denial of Service for the application. Version 5.9.0 patches the issue."
    },
    {
      "lang": "es",
      "value": "cbor2 proporciona codificación y decodificación para el formato de serialización Concise Binary Object Representation (CBOR). Las versiones anteriores a la 5.9.0 son vulnerables a un ataque de denegación de servicio (DoS) causado por recursión incontrolada al decodificar estructuras CBOR profundamente anidadas. Esta vulnerabilidad afecta tanto a la implementación pura de Python como a la extensión C '_cbor2'. La extensión C se basa en los límites de recursión internos de Python 'Py_EnterRecursiveCall' en lugar de un límite de profundidad basado en datos, lo que significa que aún genera 'RecursionError' y bloquea el proceso de trabajo cuando se alcanza el límite. Aunque la biblioteca maneja niveles de anidamiento moderados, carece de un límite de profundidad estricto. Un atacante puede proporcionar una carga útil CBOR manipulada que contenga aproximadamente 100.000 arrays anidados '0x81'. Cuando 'cbor2.loads()' intenta analizar esto, alcanza la profundidad máxima de recursión del intérprete de Python o agota la pila, lo que provoca que el proceso falle con un 'RecursionError'. Debido a que la biblioteca no impone sus propios límites, permite que un atacante externo agote el recurso de pila de la aplicación anfitriona. En muchos servidores de aplicaciones web (p. ej., Gunicorn, Uvicorn) o colas de tareas (Celery), un 'RecursionError' no manejado termina el proceso de trabajo inmediatamente. Al enviar un flujo de estos pequeños paquetes maliciosos (&lt;100KB), un atacante puede bloquear repetidamente los procesos de trabajo, lo que resulta en una denegación de servicio completa para la aplicación. La versión 5.9.0 corrige el problema."
    }
  ],
  "lastModified": "2026-06-17T10:25:56.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:agronholm:cbor2:*:*:*:*:*:python:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DAC7F8CF-AB35-48ED-B4F6-5DEDFCE12F61",
              "versionEndExcluding": "5.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}