AIKIDO-2026-746069

TL;DR

The Rust-based decoder accumulates indefinite-length and large definite-length byte and text strings by concatenating each decoded chunk onto the running result with +, reallocating and copying the whole buffer on every chunk. Decoding attacker-supplied CBOR that uses many indefinite-length chunks or very large strings therefore takes time quadratic in the input size. An attacker who can submit CBOR to a decoder can force excessive CPU consumption and stall processing with a moderately sized payload. The fix builds each string once using writer-based accumulation and validates indefinite-string chunk sizes.