cbor2, a Python library for CBOR, has an uncontrolled recursion flaw in its loads function that can trigger a RecursionError and terminate the process when decoding deeply nested CBOR payloads. The bug exists in all versions before 5.9.0, affecting both the pure‑Python implementation and the C extension. Because the library does not enforce an internal nesting limit, an attacker can craft a payload with around 100,000 nested arrays, each 0x81, which typically requires less than 100 KB of data. When the decoder attempts to parse this payload, the Python interpreter’s recursion depth limit is exceeded or the stack is exhausted, leading to a crash. The result is a denial‑of‑service for any application that uses cbor2 to parse untrusted data, such as web servers, API gateways, or task queues.

The vulnerability impacts the agronholm:cbor2 library. All releases older than 5.9.0 are affected, including the pure‑Python and _cbor2 C extension implementations. Applications that depend on these versions for decoding external CBOR data—examples include web frameworks running on Gunicorn or Uvicorn, Celery workers, and any custom services that invoke cbor2.loads—are at risk.

The CVSS score of 5.5 indicates moderate severity, and the EPSS probability of less than 1 % suggests that active exploitation is currently unlikely. The issue is not listed in the CISA KEV catalog, further indicating limited known exploitation. An attacker who can supply a crafted CBOR payload to an application that invokes cbor2.loads may trigger a RecursionError, terminate the process, and repeatedly bring down worker or server instances. The attack does not require elevated privileges or code injection; it relies solely on forging input that exceeds the interpreter’s recursion limits. The effect is a service interruption rather than data compromise.