CVE-2026-26209: Agronholm Cbor2 DOS Vulnerability

CVE-2026-26209 Overview

CVE-2026-26209 is a Denial of Service (DoS) vulnerability affecting the cbor2 Python library, which provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. The vulnerability arises from uncontrolled recursion when decoding deeply nested CBOR structures, affecting both the pure Python implementation and the C extension _cbor2.

Critical Impact

An attacker can crash Python worker processes (Gunicorn, Uvicorn, Celery) by sending crafted CBOR payloads with deeply nested arrays, causing complete service disruption.

Affected Products

• agronholm cbor2 versions prior to 5.9.0
• Applications using cbor2 with web servers (Gunicorn, Uvicorn)
• Task queue systems (Celery) processing CBOR data

Discovery Timeline

• 2026-03-23 - CVE CVE-2026-26209 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-26209

Vulnerability Analysis

This vulnerability stems from the cbor2 library's failure to implement a data-driven depth limit when parsing nested CBOR structures. The C extension relies on Python's internal recursion limits via Py_EnterRecursiveCall rather than enforcing its own constraints. When processing deeply nested payloads, the library allows the Python interpreter to hit its maximum recursion depth or exhaust the call stack, resulting in a RecursionError that terminates the worker process.

The vulnerability is classified under CWE-674 (Uncontrolled Recursion), a common weakness where software does not properly control the amount of recursion that takes place, potentially leading to resource exhaustion.

Root Cause

The root cause is the absence of a hard depth limit in the cbor2 decoder implementation. While the library can handle moderate nesting levels during normal operation, it defers recursion control to Python's interpreter-level limits rather than implementing application-level safeguards. This design decision allows external input to dictate the recursion depth, creating an exploitable condition.

The cbor2.loads() function processes CBOR data by recursively calling internal decoding functions for nested structures. Without explicit depth tracking and enforcement, the decoder will continue descending into nested arrays or maps until system resources are exhausted.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker constructs a malicious CBOR payload containing approximately 100,000 nested arrays using the byte sequence 0x81 (CBOR encoding for a single-element array). When this payload is processed by cbor2.loads(), the decoder recursively attempts to parse each nested level.

The crafted payload is relatively small (under 100KB), making it trivial to transmit repeatedly. In production environments using process-based worker models such as Gunicorn, Uvicorn, or Celery, an unhandled RecursionError causes immediate worker termination. By streaming multiple malicious packets, an attacker can systematically crash all available workers, achieving complete Denial of Service.

The attack mechanism works as follows: the attacker sends the malicious CBOR payload to an endpoint that deserializes CBOR data. The cbor2.loads() function begins parsing and recursively processes each nested array. Once the recursion depth exceeds Python's limit (typically around 1000 frames), a RecursionError is raised. Since this exception is often unhandled in worker processes, the entire worker terminates, reducing application capacity.

Detection Methods for CVE-2026-26209

Indicators of Compromise

• Sudden worker process crashes with RecursionError exceptions in application logs
• Increased memory consumption followed by process termination during CBOR deserialization
• Repeated receipt of small network packets (under 100KB) containing repetitive 0x81 byte patterns
• Elevated crash rates in Gunicorn, Uvicorn, or Celery worker processes handling CBOR endpoints

Detection Strategies

• Monitor application logs for RecursionError exceptions originating from cbor2 module calls
• Implement payload size and structure validation before CBOR deserialization
• Deploy network-level inspection for CBOR payloads with suspicious repetitive byte patterns
• Set up alerting for worker process restart frequency exceeding baseline thresholds

Monitoring Recommendations

• Enable stack trace logging for all worker process crashes to identify cbor2-related terminations
• Configure APM tools to track cbor2.loads() execution time and failure rates
• Monitor system-level metrics for abnormal memory spikes during request processing
• Implement request logging to correlate incoming payloads with worker crashes

How to Mitigate CVE-2026-26209

Immediate Actions Required

• Upgrade cbor2 to version 5.9.0 or later immediately across all environments
• Audit application code to identify all endpoints and functions that deserialize CBOR data
• Implement input validation to reject CBOR payloads exceeding expected size thresholds
• Consider wrapping cbor2.loads() calls in exception handlers to prevent worker termination

Patch Information

The vulnerability is patched in cbor2 version 5.9.0. The fix introduces a configurable depth limit that prevents uncontrolled recursion during CBOR decoding. Users should upgrade using pip:

pip install --upgrade cbor2>=5.9.0

For detailed information about the fix, refer to the GitHub Security Advisory GHSA-3c37-wwvx-h642, the GitHub Pull Request Discussion, and the GitHub Commit Changes.

Workarounds

• Implement a custom depth-limiting wrapper around cbor2.loads() that tracks nesting depth
• Add input size validation to reject CBOR payloads larger than expected for your application
• Deploy rate limiting on endpoints that process CBOR data to mitigate attack throughput
• Configure worker process supervisors to automatically restart crashed workers with delay

# Upgrade cbor2 to patched version
pip install cbor2>=5.9.0

# Verify installed version
pip show cbor2 | grep Version

# For requirements.txt, specify minimum version
echo "cbor2>=5.9.0" >> requirements.txt