Detections
Analytics

SCA: security update for cbor2 (GHSA-3c37-wwvx-h642)

high Tenable Self-Hosted Container Security Plugin ID 439131

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization
 format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled
 recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python
 implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits
 `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError`
 and crashes the worker process when the limit is hit. While the library handles moderate nesting levels,
 it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately
 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python
 interpreter's maximum recursion depth or exhausts the stack, causing the process to crash with a
 `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to
 exhaust the host application's stack resource. In many web application servers (e.g., Gunicorn, Uvicorn)
 or task queues (Celery), an unhandled `RecursionError` terminates the worker process immediately. By
 sending a stream of these small (<100KB) malicious packets, an attacker can repeatedly crash worker
 processes, resulting in a complete Denial of Service for the application. Version 5.9.0 patches the issue.
 (CVE-2026-26209)

Solution

Update the cbor2 library and its related packages to version 5.9.0 or later.

See Also

https://github.com/advisories/GHSA-3c37-wwvx-h642

Plugin Details

Severity: High

ID: 439131

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 3/24/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-26209

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/23/2026

Vulnerability Publication Date: 3/23/2026

Reference Information

CVE: CVE-2026-26209

cwe: CWE-674