CVE-2026-26209

CVE-2026-26209 is a high-severity Denial of Service (DoS) vulnerability impacting the agronholm cbor2 library, specifically versions prior to 5.9.0. This flaw allows an unauthenticated attacker to trigger uncontrolled recursion by sending a crafted, deeply nested CBOR payload. Such a payload exhausts the host application's stack, causing worker processes to crash and resulting in a complete Denial of Service, reflected by its CVSS score of 7.5 (High). The attack vector is network-based with low complexity, requiring no user interaction or privileges. Although there is no evidence of active exploitation or publicly available exploit code, the vulnerability has garnered limited community discussion.