AIKIDO-2025-10756

TL;DR

Affected versions of the package are vulnerable to denial of service (DoS) because decode_definite_long_string() can drive a decoder into an unlimited read loop. The function retains an outdated buffer_size after consuming UTF-8 leftovers; on the next iteration it computes chunk_length = 65536 - buffer_size, which can become negative and is then passed unchecked to read(-1). This results in an unbounded read followed by a CBORDecodeEOF error, allowing an attacker who can feed a crafted stream to cause excessive resource consumption or crash the decoder.