---
id: CVE-2024-21909
title: |-
  PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of 
  service vulnerability
summary: |-
  PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of 
  service vulnerability. An attacker may trigger the denial of service 
  condition by providing crafted data to the DecodeFromBytes or other 
  decoding mechanisms in Pet…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-407
  - CWE-407
vendor: peteroupc
product: cbor
affected:
  - 'cbor >= 4.0.0, < 4.5.1'
patched:
  - cbor 4.5.1
published: '2024-01-03'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-21909'
references:
  - url: 'https://github.com/advisories/GHSA-6r92-cgxc-r5fg'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95
    label: disclosure@vulncheck.com
  - url: 'https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg'
    label: disclosure@vulncheck.com
  - url: 'https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/advisories/GHSA-6r92-cgxc-r5fg'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/peteroupc/CBOR/commit/b4117dbbb4cd5a4a963f9d0c9aa132f033e15b95
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/peteroupc/CBOR/compare/v4.5...v4.5.1'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://github.com/peteroupc/CBOR/security/advisories/GHSA-6r92-cgxc-r5fg'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://vulncheck.com/advisories/vc-advisory-GHSA-6r92-cgxc-r5fg'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.01061
epssPercentile: 0.63152
ingestedAt: '2026-07-14T23:40:04.505Z'
---

## Overview

PeterO.Cbor versions 4.0.0 through 4.5.0 are vulnerable to a denial of 
service vulnerability. An attacker may trigger the denial of service 
condition by providing crafted data to the DecodeFromBytes or other 
decoding mechanisms in PeterO.Cbor. Depending on the usage of the 
library, an unauthenticated and remote attacker may be able to cause the
 denial of service condition.

## Affected

- `cbor >= 4.0.0, < 4.5.1`

## Remediation

Upgrade past the affected range:

- `cbor 4.5.1`