Vulnerability-Lookup - Search a vulnerability

Refine your search

Product

Sort by

Order

Sources

CVE-2026-63374 (GCVE-0-2026-63374)

Vulnerability from cvelistv5

Published

2026-09-22 15:23

Modified

2026-09-28 16:32

Severity ?

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-295 - Improper Certificate Validation
CWE-297 - Improper Validation of Certificate with Host Mismatch

Summary

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate. This issue is fixed in version 4.14.2.

References

URL

Tags

	https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6	x_refsource_CONFIRM
	https://github.com/agronholm/anyio/pull/1208	x_refsource_MISC
	https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce	x_refsource_MISC
	https://github.com/agronholm/anyio/releases/tag/4.14.2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	agronholm	anyio	Version: < 4.14.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63374",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-28T16:07:36.655203Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-28T16:32:29.169Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "anyio",
          "vendor": "agronholm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.14.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint\u0027s certificate to validate. This issue is fixed in version 4.14.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-297",
              "description": "CWE-297: Improper Validation of Certificate with Host Mismatch",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-22T15:23:14.259Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agronholm/anyio/security/advisories/GHSA-82r6-8w77-94w6"
        },
        {
          "name": "https://github.com/agronholm/anyio/pull/1208",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/pull/1208"
        },
        {
          "name": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/commit/68f58915f82d9be8109ebbbd8f5d70577d43f2ce"
        },
        {
          "name": "https://github.com/agronholm/anyio/releases/tag/4.14.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
        }
      ],
      "source": {
        "advisory": "GHSA-82r6-8w77-94w6",
        "discovery": "UNKNOWN"
      },
      "title": "AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63374",
    "datePublished": "2026-09-22T15:23:14.259Z",
    "dateReserved": "2026-07-16T17:39:30.170Z",
    "dateUpdated": "2026-09-28T16:32:29.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-64847 (GCVE-0-2026-64847)

Vulnerability from cvelistv5

Published

2026-09-18 17:04

Modified

2026-09-18 18:07

Severity ?

6.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Summary

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.

References

URL

Tags

	https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp	x_refsource_CONFIRM
	https://github.com/agronholm/anyio/pull/1207	x_refsource_MISC
	https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040	x_refsource_MISC
	https://github.com/agronholm/anyio/releases/tag/4.14.2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	agronholm	anyio	Version: < 4.14.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-64847",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-18T18:07:19.030895Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-18T18:07:27.772Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "anyio",
          "vendor": "agronholm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.14.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "LOCAL",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770: Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:04:32.038Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agronholm/anyio/security/advisories/GHSA-5p39-cfhj-2xmp"
        },
        {
          "name": "https://github.com/agronholm/anyio/pull/1207",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/pull/1207"
        },
        {
          "name": "https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/commit/f1b7301c8264b0d2e8d24a5788fd29e93dea4040"
        },
        {
          "name": "https://github.com/agronholm/anyio/releases/tag/4.14.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
        }
      ],
      "source": {
        "advisory": "GHSA-5p39-cfhj-2xmp",
        "discovery": "UNKNOWN"
      },
      "title": "AnyIO process-pool workers can block indefinitely on undrained stderr"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-64847",
    "datePublished": "2026-09-18T17:04:32.038Z",
    "dateReserved": "2026-07-20T18:31:39.290Z",
    "dateUpdated": "2026-09-18T18:07:27.772Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-63349 (GCVE-0-2026-63349)

Vulnerability from cvelistv5

Published

2026-09-18 17:02

Modified

2026-09-24 21:05

Severity ?

7.0 (High) - CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-266 - Incorrect Privilege Assignment
CWE-269 - Improper Privilege Management

Summary

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2.

References

URL

Tags

	https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26	x_refsource_CONFIRM
	https://github.com/agronholm/anyio/pull/1209	x_refsource_MISC
	https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200	x_refsource_MISC
	https://github.com/agronholm/anyio/releases/tag/4.14.2	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	agronholm	anyio	Version: >= 4.14.0, < 4.14.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T21:00:28.848164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T21:05:25.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "anyio",
          "vendor": "agronholm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 4.14.0, \u003c 4.14.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_process() forwards the group argument to the backend instead of extra_groups. A caller that supplies extra_groups=[] to clear inherited supplementary groups can therefore launch a child that retains the parent process groups, undermining a privilege-dropping boundary. If group is also supplied, the integer group value is passed where an iterable of supplementary groups is expected and the launch can fail with TypeError. This issue affects POSIX applications that rely on AnyIO subprocess helpers to launch less-privileged child processes. This issue is fixed in version 4.14.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-266",
              "description": "CWE-266: Incorrect Privilege Assignment",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:02:30.273Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agronholm/anyio/security/advisories/GHSA-3w57-8xmc-8v26"
        },
        {
          "name": "https://github.com/agronholm/anyio/pull/1209",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/pull/1209"
        },
        {
          "name": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/commit/eb562e6462ee46b1904e50b02ce00a858cdeb200"
        },
        {
          "name": "https://github.com/agronholm/anyio/releases/tag/4.14.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/anyio/releases/tag/4.14.2"
        }
      ],
      "source": {
        "advisory": "GHSA-3w57-8xmc-8v26",
        "discovery": "UNKNOWN"
      },
      "title": "AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63349",
    "datePublished": "2026-09-18T17:02:30.273Z",
    "dateReserved": "2026-07-16T14:14:24.386Z",
    "dateUpdated": "2026-09-24T21:05:25.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-26209 (GCVE-0-2026-26209)

Vulnerability from cvelistv5

Published

2026-03-23 18:53

Modified

2026-03-24 18:35

Severity ?

7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-674 - Uncontrolled Recursion

Summary

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError` and crashes the worker process when the limit is hit. While the library handles moderate nesting levels, it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python interpreter's maximum recursion depth or exhausts the stack, causing the process to crash with a `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to exhaust the host application's stack resource. In many web application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery), an unhandled `RecursionError` terminates the worker process immediately. By sending a stream of these small (<100KB) malicious packets, an attacker can repeatedly crash worker processes, resulting in a complete Denial of Service for the application. Version 5.9.0 patches the issue.

References

URL

Tags

	https://github.com/agronholm/cbor2/security/advisories/GHSA-3c37-wwvx-h642	x_refsource_CONFIRM
	https://github.com/agronholm/cbor2/pull/275	x_refsource_MISC
	https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b	x_refsource_MISC
	https://github.com/agronholm/cbor2/releases/tag/5.9.0	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	agronholm	cbor2	Version: < 5.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-26209",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T18:35:22.617238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T18:35:35.486Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cbor2",
          "vendor": "agronholm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python\u0027s internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError` and crashes the worker process when the limit is hit. While the library handles moderate nesting levels, it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python interpreter\u0027s maximum recursion depth or exhausts the stack, causing the process to crash with a `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to exhaust the host application\u0027s stack resource. In many web application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery), an unhandled `RecursionError` terminates the worker process immediately. By sending a stream of these small (\u003c100KB) malicious packets, an attacker can repeatedly crash worker processes, resulting in a complete Denial of Service for the application. Version 5.9.0 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "CWE-674: Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-23T18:53:10.268Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agronholm/cbor2/security/advisories/GHSA-3c37-wwvx-h642",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-3c37-wwvx-h642"
        },
        {
          "name": "https://github.com/agronholm/cbor2/pull/275",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/pull/275"
        },
        {
          "name": "https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/commit/e61a5f365ba610d5907a0ae1bc72769bba34294b"
        },
        {
          "name": "https://github.com/agronholm/cbor2/releases/tag/5.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/releases/tag/5.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-3c37-wwvx-h642",
        "discovery": "UNKNOWN"
      },
      "title": "cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-26209",
    "datePublished": "2026-03-23T18:53:10.268Z",
    "dateReserved": "2026-02-11T19:56:24.814Z",
    "dateUpdated": "2026-03-24T18:35:35.486Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-68131 (GCVE-0-2025-68131)

Vulnerability from cvelistv5

Published

2025-12-31 01:15

Modified

2026-01-02 14:37

Severity ?

5.5 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

CWE

CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer

Summary

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.

References

URL

Tags

	https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh	x_refsource_CONFIRM
	https://github.com/agronholm/cbor2/pull/268	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	agronholm	cbor2	Version: >= 3.0.0, < 5.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-68131",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-02T14:22:41.499483Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-02T14:37:55.705Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cbor2",
          "vendor": "agronholm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.0.0, \u003c 5.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-212",
              "description": "CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-12-31T01:15:36.827Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh"
        },
        {
          "name": "https://github.com/agronholm/cbor2/pull/268",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/pull/268"
        }
      ],
      "source": {
        "advisory": "GHSA-wcj4-jw5j-44wh",
        "discovery": "UNKNOWN"
      },
      "title": "CBORDecoder reuse can leak shareable values across decode calls"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-68131",
    "datePublished": "2025-12-31T01:15:36.827Z",
    "dateReserved": "2025-12-15T18:05:52.210Z",
    "dateUpdated": "2026-01-02T14:37:55.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-26134 (GCVE-0-2024-26134)

Vulnerability from cvelistv5

Published

2024-02-19 22:13

Modified

2025-02-13 17:41

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Summary

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.

References

URL

Tags

	https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m	x_refsource_CONFIRM
	https://github.com/agronholm/cbor2/pull/204	x_refsource_MISC
	https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542	x_refsource_MISC
	https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df	x_refsource_MISC
	https://github.com/agronholm/cbor2/releases/tag/5.6.2	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/
	https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/

Impacted products

	Vendor	Product	Version
	agronholm	cbor2	Version: >= 5.5.1, < 5.6.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:59:32.554Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
          },
          {
            "name": "https://github.com/agronholm/cbor2/pull/204",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/agronholm/cbor2/pull/204"
          },
          {
            "name": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
          },
          {
            "name": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
          },
          {
            "name": "https://github.com/agronholm/cbor2/releases/tag/5.6.2",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:agronholm:cbor2:5.5.1:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cbor2",
            "vendor": "agronholm",
            "versions": [
              {
                "lessThan": "5.6.2",
                "status": "affected",
                "version": "5.5.1",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26134",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-20T18:24:08.985048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-14T13:57:54.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cbor2",
          "vendor": "agronholm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.5.1, \u003c 5.6.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "CWE-120: Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-04-19T23:06:51.306Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m"
        },
        {
          "name": "https://github.com/agronholm/cbor2/pull/204",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/pull/204"
        },
        {
          "name": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542"
        },
        {
          "name": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df"
        },
        {
          "name": "https://github.com/agronholm/cbor2/releases/tag/5.6.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/"
        }
      ],
      "source": {
        "advisory": "GHSA-375g-39jq-vq7m",
        "discovery": "UNKNOWN"
      },
      "title": "CBOR2 decoder has potential buffer overflow"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-26134",
    "datePublished": "2024-02-19T22:13:47.173Z",
    "dateReserved": "2024-02-14T17:40:03.687Z",
    "dateUpdated": "2025-02-13T17:41:03.627Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Refine your search

6 vulnerabilities found for by agronholm

CVE-2026-63374 (GCVE-0-2026-63374)

Vulnerability from cvelistv5

CVE-2026-64847 (GCVE-0-2026-64847)

Vulnerability from cvelistv5

CVE-2026-63349 (GCVE-0-2026-63349)

Vulnerability from cvelistv5

CVE-2026-26209 (GCVE-0-2026-26209)

Vulnerability from cvelistv5

CVE-2025-68131 (GCVE-0-2025-68131)

Vulnerability from cvelistv5

CVE-2024-26134 (GCVE-0-2024-26134)

Vulnerability from cvelistv5