Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

agronholm/cbor2

              master @ c348bbf
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 13 prior fixes. Scrutinize any change in this area.

source/decoder.c: most-fixed (12 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Uncontrolled recursion in nested CBOR structures allows remote attackers to exhaust stack space and crash the decoding process, as addressed in CVE-2026-26209. Both the C and Python implementations must strictly enforce recursion depth limits.

Information Disclosure: Reusing CBORDecoder/CBOREncoder instances across trust boundaries can leak shared reference states (like shareable tags) between distinct decoding runs, resulting in data leakage across independent messages (CVE-2025-68131).

Denial of Service: Maliciously constructed long string lengths in CBOR headers can trick the decoder into making excessive memory allocation requests, leading to server-side resource exhaustion.