AIKIDO-2026-925863

TL;DR

The C extension decoder in cbor2 decodes a definite-length text string larger than 64 KB by reading it in chunks and concatenating them. Each concatenation allocates a new combined string but the previous intermediate string is never released, so memory accumulates for every chunk and is retained for the lifetime of the process. Decoding untrusted CBOR text strings from a network source lets a caller retain large amounts of unreclaimed memory and eventually exhaust available resources. The fix releases each intermediate result before it is overwritten by the concatenated string.