CVE Feed

    Dashboard / CVE / CVE-2024-26134

    CVE-2024-26134

    cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

    Published:Feb 19, 2024
    Last Modified:Feb 13, 2025
    EPS:Feb 19, 2024
    EPSS Score:0.00809
    CVSS Score:7.5

    Affected Products

    Vendor
    Agronholm
    Product
    Cbor2
    Vendor
    Fedoraproject
    Product
    Fedora

    Exploits

    https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7mhttps://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m

    References

    https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542
    https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df
    https://github.com/agronholm/cbor2/pull/204
    https://github.com/agronholm/cbor2/releases/tag/5.6.2
    https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m
    https://lists.fedoraproject.org/archives/list/[email protected]/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/
    https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542
    https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df
    https://github.com/agronholm/cbor2/pull/204
    https://github.com/agronholm/cbor2/releases/tag/5.6.2
    https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m
    https://lists.fedoraproject.org/archives/list/[email protected]/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/
    https://lists.fedoraproject.org/archives/list/[email protected]/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High