cve/2024/CVE-2024-26134.md

### [CVE-2024-26134](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-26134)
![](https://img.shields.io/static/v1?label=Product&message=cbor2&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3E%3D%205.5.1%2C%20%3C%205.6.2%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-120%3A%20Buffer%20Copy%20without%20Checking%20Size%20of%20Input%20('Classic%20Buffer%20Overflow')&color=brighgreen)

### Description

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

### POC

#### Reference
- https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m

#### Github
No PoCs found on GitHub currently.