CVE-2024-26134

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-261358.8MeshCentral is a full computer management web site. Versions prior to 1.1.21 a cross-site websocket hijacking (CSWSH) vulnerability within t CVE-2024-261367.5kedi ElectronCord is a bot management tool for Discord. Commit aaaeaf4e6c99893827b2eea4dd02f755e1e24041 exposes an account access token in t CVE-2024-261385.3The XWiki licensor application, which manages and enforce application licenses for paid extensions, includes the document `Licenses.Code.Lic CVE-2024-261398.1OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Due to lack o CVE-2024-26148.8Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. Some of these bugs showed evidence of memory corruption CVE-2024-261406.1com.yetanalytics/lrs is the Yet Analytics Core LRS Library. Prior to version 1.2.17 of the LRS library and version 0.7.5 of SQL LRS, a malic CVE-2024-261417.5Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large respon CVE-2024-261427.5Rails is a web-application framework. Starting in version 7.1.0, there is a possible ReDoS vulnerability in the Accept header parsing routin CVE-2024-261436.1Rails is a web-application framework. There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applica CVE-2024-261445.3Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage.CVE-2024-261454.3Discourse Calendar adds the ability to create a dynamic calendar in the first post of a topic on Discourse. Uninvited users are able to gain CVE-2024-261467.5Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulti