CVE-2024-21909

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of service vulnerability. An attacker may trigger the denial of service condition by providing crafted data to the DecodeFromBytes or other decoding mechanisms in PeterO.Cbor. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

• CWE-407
• CWE-407

• https://github.com/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
• https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95Patch
• https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1Release Notes
• https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
• https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fgThird Party Advisory
• https://github.com/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
• https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95Patch
• https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1Release Notes
• https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fgThird Party Advisory
• https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fgThird Party Advisory

Published

Jan 3, 2024

Last Modified

Jul 14, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-21903An OS command injection vulnerability has been reported to a…4.7
• CVE-2024-21904A path traversal vulnerability has been reported to affect s…6.5
• CVE-2024-21905An integer overflow or wraparound vulnerability has been rep…8.2
• CVE-2024-21906An OS command injection vulnerability has been reported to a…4.7
• CVE-2024-21907Newtonsoft.Json before version 13.0.1 is affected by a misha…7.5
• CVE-2024-21908TinyMCE versions before 5.9.0 are affected by a stored cross…6.1
• CVE-2024-2191An issue was discovered in GitLab CE/EE affecting all versio…5.3
• CVE-2024-21910TinyMCE versions before 5.10.0 are affected by a cross-site …6.1
• CVE-2024-21911TinyMCE versions before 5.6.0 are affected by a stored cross…6.1
• CVE-2024-21912 An arbitrary code execution vulnerability in Rockwell Autom…7.8
• CVE-2024-21913 A heap-based memory buffer overflow vulnerability in Rockwe…7.8
• CVE-2024-21914 A vulnerability exists in the affected product that allows …5.3