AIKIDO-2026-273917

TL;DR

The CBOR decoder normalizes decoded documents without bounding the work each element can cost. Decoding untrusted CBOR triggers quadratic map normalization, eager expansion of decimal fraction and big float exponents into very large strings, and quadratic big number base conversion, so a small hostile document exhausts CPU and memory and can raise an uncatchable fatal error that terminates the PHP process. Other inputs throw exceptions outside the documented error contract. The fix bounds exponents and big number payload sizes, rejects expensive container map keys before normalizing them, and replaces the quadratic map normalization.