AIKIDO-2026-402067

TL;DR

The BigFloatTag and DecimalFractionTag normalization computes the tag value by raising 2 or 10 to an exponent taken directly from the decoded document using bcpow(). The exponent is never bounded, so a tiny CBOR payload can request a number with billions of digits and force a huge memory allocation. Because this surfaces as a fatal memory-exhaustion error it cannot be caught by the caller, terminating the PHP process when decoding untrusted input. The fix rejects exponents whose absolute value exceeds a fixed maximum before the expensive computation.