The cbor2 library, versions prior to 5.9.0, contains a critical uncontrolled recursion vulnerability that allows unauthenticated attackers to trigger a Denial of Service by crashing the host process.

This vulnerability involves uncontrolled recursion (CWE-674) within the cbor2 decoding logic. An unauthenticated attacker can supply a specially crafted CBOR payload with excessive nesting to exhaust the stack or exceed recursion limits, causing the application to terminate unexpectedly.

A successful exploit results in a Denial of Service by crashing the application process. Given that cbor2 is frequently used in web servers and task queues, this impact can lead to significant service outages, performance degradation, and operational disruption. With a CVSS score of 7.5, this vulnerability represents a high-severity risk to system availability.

Immediate Action: Update the cbor2 package to version 5.9.0 or later to implement the necessary recursion depth limits.

Proactive Monitoring: Review application logs for recurring RecursionError exceptions or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Implement request size and structure validation at the gateway or web application firewall level to reject abnormally nested or deeply recursive serialized payloads.

Public Exploit Available: Unknown.

Organizations utilizing the cbor2 library must prioritize updating to version 5.9.0 immediately to resolve this recursion flaw. Given the ease of triggering a process crash via a single malicious payload, failing to patch leaves critical infrastructure components susceptible to trivial service disruption.