CVE-2024-26134

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

• CWE-120
• CWE-120

• https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542Product
• https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873dfPatch
• https://github.com/agronholm/cbor2/pull/204Issue Tracking
• https://github.com/agronholm/cbor2/releases/tag/5.6.2Release Notes
• https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7mExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/Mailing List
• https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542Product
• https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873dfPatch
• https://github.com/agronholm/cbor2/pull/204Issue Tracking
• https://github.com/agronholm/cbor2/releases/tag/5.6.2Release Notes
• https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7mExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/Mailing List
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/Mailing List

Published

Feb 19, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-26129PrestaShop is an open-source e-commerce platform. Starting i…5.3
• CVE-2024-2613Data was not properly sanitized when decoding a QUIC ACK fra…7.5
• CVE-2024-26130cryptography is a package designed to expose cryptographic p…7.5
• CVE-2024-26131Element Android is an Android Matrix Client. Element Android…7.8
• CVE-2024-26132Element Android is an Android Matrix Client. A third-party m…3.3
• CVE-2024-26133EventStoreDB (ESDB) is an operational database built to stor…4.9
• CVE-2024-26135MeshCentral is a full computer management web site. Versions…8.8
• CVE-2024-26136kedi ElectronCord is a bot management tool for Discord. Comm…7.5
• CVE-2024-26138The XWiki licensor application, which manages and enforce ap…5.3
• CVE-2024-26139OpenCTI is an open source platform allowing organizations to…8.1
• CVE-2024-2614Memory safety bugs present in Firefox 123, Firefox ESR 115.8…8.8
• CVE-2024-26140com.yetanalytics/lrs is the Yet Analytics Core LRS Library. …6.1