AIKIDO-2026-413819

cbor2 is vulnerable to Denial of Service (DoS)

Denial of Service (DoS) Pre-CVE Published Aug 10, 2026

Medium Risk

This Affects:

cbor2

4.1.0 - 6.1.3

Fixed in 6.1.4

Are you affected? Scan for Free

TL;DR

The cbor2 decoder constructs a frozendict for every CBOR map decoded in an immutable position, such as a map used as a key. The frozendict derived its hash from its keys and its values as two independent sets, so many distinct maps sharing the same keys and values collided into a single hash value regardless of how keys and values were paired. A crafted payload keyed by large numbers of such colliding maps forces the decoder into quadratic-time processing, consuming excessive CPU when parsing untrusted input. The fix hashes paired key and value items together so distinct maps no longer collide.

Who does this affect?

You are affected if your application decodes untrusted or externally-influenced CBOR with the default decoder and the input can contain maps in immutable positions (map keys, set members, tag payloads, or immutable=True), which the decoder turns into frozendict objects. No opt-in feature or special configuration is required. The vulnerable frozendict hashing is used on CPython 3.14 and earlier; on Python 3.15 the decoder uses the built-in frozendict, which is not affected.