AIKIDO-2026-981028

TL;DR

Pubnub::Cbor decodes CBOR-encoded PubNub access tokens without bounding recursion depth, per-container element counts, or total input size. When a malformed or attacker-crafted token is passed to Pubnub::Client#parse_token, the decoder can recurse until it raises SystemStackError, spin on truncated input, or attempt very large allocations, hanging or crashing the caller. An attacker who can supply token input to the parser can therefore trigger a denial of service. The fix caps recursion depth, per-container length, and total input size, adds bounded byte consumption, and raises Pubnub::Cbor::DecodeError on malformed input.