CVE catalog
CVE-2024-26134
cbor2: CVE-2024-26134
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.18% · Oct 25, 2026
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | cbor2 | sid | 6.1.2-2 | fixed |
| Debian | cbor2 | forky | 6.1.2-2 | fixed |
| Debian | cbor2 | trixie | 5.6.5-1 | fixed |
| Debian | cbor2 | bookworm | 5.4.6-1 | not affected |
| Opensuse | python-cbor2 | leap 16.0 | 5.6.5-160000.3.1 | fixed |
| Suse | python-cbor2 | linux enterprise server 16.0 | 5.6.5-160000.3.1 | fixed |
| Suse | python-cbor2 | linux enterprise server for sap applications 16.0 | 5.6.5-160000.3.1 | fixed |
| Opensuse | python-cbor2 | tumbleweed | 5.6.5-2.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | cbor2 | source | sid | 5.6.2-1 | not yet assigned | Not reported | [1064416] |
| Debian | cbor2 | source | forky | 5.6.2-1 | not yet assigned | Not reported | [1064416] |
| Debian | cbor2 | source | trixie | 5.6.2-1 | not yet assigned | Not reported | [1064416] |
| Debian | cbor2 | source | bookworm | Not affected | unimportant | Not reported | [1064416] |
| Opensuse | python-cbor2 | rpm | leap 16.0 | 5.6.5-160000.3.1 | Not reported | OPENSUSE-SU-2025:20133-1 | Not reported |
| Suse | python-cbor2 | rpm | linux enterprise server 16.0 | 5.6.5-160000.3.1 | Not reported | SUSE-SU-2025:21168-1 | Not reported |
| Suse | python-cbor2 | rpm | linux enterprise server for sap applications 16.0 | 5.6.5-160000.3.1 | Not reported | SUSE-SU-2025:21168-1 | Not reported |
| Opensuse | python-cbor2 | rpm | tumbleweed | 5.6.5-2.1 | Not reported | OPENSUSE-SU-2025:14733-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_21168-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-26134]
- [https://osv.dev/vulnerability/SUSE-SU-2025:21168-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14733-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:20133-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-26134]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26134.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]