p PatchFirst

CVE-2024-26134

CVE-2024-26134 · CBOR2 decoder has potential buffer overflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

CVSS 7.5 · High · EPSS 1.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cbor2

    Versions
    • >= 5.5.1, < 5.6.2: Affected

    No fix published

  • cbor2 Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.6.2-1

    Update to 5.6.2-1

  • cbor2 Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.6.2-1

    Update to 5.6.2-1

  • cbor2 PyPI

    Versions
    • 5.5.1
    • 5.6.0
    • 5.6.1
    Affected ranges
    • ECOSYSTEM: ≥ 5.5.1, < 5.6.2

    Update to 5.6.2

  • cbor2 PyPI

    Versions
    • 5.5.1
    • 5.6.0
    • 5.6.1
    • 5.5.0
    • 5.4.6
    • 5.4.5
    • 5.4.4
    • 5.4.3
    • 5.4.2.post1
    • 5.2.0
    • 5.4.2
    • 5.4.1
    • 5.4.0
    • 5.3.0
    • 5.1.2
    • 5.1.1
    • 5.1.0
    • 5.0.1
    • 5.0.0
    • 4.2.0
    • 4.1.2
    • 4.1.1
    • 4.1.0
    • 4.0.1
    • 4.0.0
    • 3.0.4
    • 3.0.3
    • 3.0.2
    • 3.0.1
    • 3.0.0
    • 2.0.0
    • 1.1.0
    • 1.0.0
    Affected ranges
    • {"events": [{"introduced": "0"}, {"fixed": "387755eacf0be35591a478d3c67fe10618a6d542"}, {"fixed": "4de6991ba29bf2290d7b9d83525eda7d021873df"}], "repo": "https://github.com/agronholm/cbor2", "type": "GIT"}
    • ECOSYSTEM: ≥ 5.5.1, < 5.6.2

    Update to 5.6.2

  • cbor2 Ubuntu:22.04:LTS

    Versions
    • 5.2.0-4
    • 5.2.0-4build1
    • 5.4.2-1
    • 5.4.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:24.04:LTS

    Versions
    • 5.4.6-2
    • 5.4.6-2build1
    • 5.5.1-1
    • 5.6.0-1
    • 5.6.1-1
    • 5.6.2-1
    • 5.6.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:25.10

    Versions
    • 5.6.5-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:26.10

    Versions
    • 5.8.0-2ubuntu1
    • 6.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:26.04:LTS

    Versions
    • 5.6.5-1build1
    • 5.7.0-1
    • 5.7.1-1
    • 5.8.0-1
    • 5.8.0-2ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →