Vulnerabilities for cbor2

First version without a known vulnerability: 5.9.0

Details

• GHSA-3c37-wwvx-h6422026-03-23

  cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads

  Fixed in: 5.9.0

• GHSA-wcj4-jw5j-44wh2025-12-31

  CBORDecoder reuse can leak shareable values across decode calls

  Fixed in: 5.8.0

• GHSA-9q9c-vjxh-p7952025-11-18

  cbor2 C extension decoder flaws can cause denial of service

  Fixed in: 5.7.1

• GHSA-375g-39jq-vq7m2024-02-21

  Potential buffer overflow in CBOR2 decoder

  Fixed in: 5.6.2, 387755eacf0be35591a478d3c67fe10618a6d542, 4de6991ba29bf2290d7b9d83525eda7d021873df