Threats tagged 'brew-keeper-commander-cve-2026-26209'

The cbor2 library used by keeper-commander is vulnerable to a Denial of Service (DoS) attack due to uncontrolled recursion when decoding deeply nested CBOR data structures. An attacker can craft a CBOR payload with thousands of nested arrays that causes the decoder to exceed Python's recursion limit, triggering a RecursionError. In some environments, this exception is not properly handled, causing the process to terminate. This vulnerability affects both the pure Python and C extension implementations of cbor2. It impacts applications parsing untrusted CBOR data, such as IoT systems and WebAuthn flows. The issue is patched in keeper-commander versions 17.1.13 and 17.2.10_1.