CVE-2026-26209·Python vulnerability
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Versions prior to 5.9.0 are vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding deeply nested CBOR structures. This vulnerability affects both the pure Python implementation and the C extension `_cbor2`. The C extension relies on Python's internal recursion limits `Py_EnterRecursiveCall` rather than a data-driven depth limit, meaning it still raises `RecursionError` and crashes the worker process when the limit is hit. While the library handles moderate nesting levels, it lacks a hard depth limit. An attacker can supply a crafted CBOR payload containing approximately 100,000 nested arrays `0x81`. When `cbor2.loads()` attempts to parse this, it hits the Python interpreter's maximum recursion depth or exhausts the stack, causing the process to crash with a `RecursionError`. Because the library does not enforce its own limits, it allows an external attacker to exhaust the host application's stack resource. In many web application servers (e.g., Gunicorn, Uvicorn) or task queues (Celery), an unhandled `RecursionError` terminates the worker process immediately. By sending a stream of these small (<100KB) malicious packets, an attacker can repeatedly crash worker processes, resulting in a complete Denial of Service for the application. Version 5.9.0 patches the issue.
- Severity
- high
- Software
- Python
- Fixed in
- 5.9.0
- Published
- 2026-03-23
Affected versions
Until: 5.9.0
Fixed in: 5.9.0
How to fix this CVE
Update the cbor2 Python library to version 5.9.0 or later to patch the recursive parsing vulnerability. If your application uses cbor2 for CBOR deserialization, prioritize this update to prevent worker process crashes from malicious payloads. After patching, restart all application services and worker processes to load the fixed library.
sudo dnf update python3-cbor2 || sudo pip3 install --upgrade cbor2>=5.9.0Defensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
POST requests or socket data containing CBOR-encoded payloads with repeated 0x81 bytes (nested array markers) exceeding 100+ levels deep; application logs showing `RecursionError: maximum recursion depth exceeded` followed by worker process termination (exit code non-zero)WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
Implement WAF rules to limit CBOR payload size (reject payloads >50KB) and monitor for suspicious CBOR structures with excessive nesting; rate-limit requests from the same source that trigger RecursionError responsesHow to check if you are affected
- Run `python3 -c "import cbor2; print(cbor2.__version__)"` to check the installed cbor2 version; versions before 5.9.0 are vulnerable.
- Identify applications using cbor2 by searching for import statements: `grep -r "import cbor2" /opt /srv /home --include="*.py" 2>/dev/null`
- Check application logs for `RecursionError` exceptions and abnormal worker terminations: `grep -i "recursionerror\|maximum recursion" /var/log/application.log /var/log/gunicorn.log /var/log/celery.log 2>/dev/null`
- After updating, verify the patched version is loaded: `python3 -c "import cbor2; assert cbor2.__version__ >= '5.9.0', 'Update failed'"` and restart the application service with `sudo systemctl restart {application-service}`
FAQ
What is CVE-2026-26209?
CVE-2026-26209 is a Denial of Service vulnerability in cbor2 (a CBOR serialization library) caused by uncontrolled recursion when parsing deeply nested CBOR structures. Attackers can craft small malicious CBOR payloads that exhaust the Python interpreter's stack, causing worker processes to crash with RecursionError.
Is CVE-2026-26209 being actively exploited?
No, CVE-2026-26209 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, though the vulnerability is straightforward to exploit if cbor2 is exposed to untrusted input.
What versions of cbor2 are affected by CVE-2026-26209?
All versions of cbor2 prior to 5.9.0 are vulnerable, including both the pure Python implementation and the C extension (_cbor2).
How do I check if my server is vulnerable to CVE-2026-26209?
Run `python3 -c "import cbor2; print('Vulnerable' if cbor2.__version__ < '5.9.0' else 'Patched')"` to determine your cbor2 version status.
Does Defensia detect CVE-2026-26209?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If cbor2 is installed on a monitored server, CVE-2026-26209 will appear in your dashboard with remediation steps.
Related Python CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-26209. Free for 1 server.
Get started free