PT-2026-79795

Name of the Vulnerable Software and Affected Versions warmcat libwebsockets version 4.5.0 Description A remote out-of-bounds write can occur within the LECP CBOR Recording component. The issue resides in the report raw cbor function located in the lib/misc/lecp.c file. Recommendations Apply patch...

CVE-2026-78161: Out-of-bounds Write

A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function reportrawcbor of the file lib/misc/lecp.c of the component LECP CBOR Recording. The manipulation results in out-of-bounds write. The attack can be launched remotely. The exploit has been made public and could be...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5492992044236800 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=6024338403557376 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5126226298339328 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=5482017228390400 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=4790812572188672 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=6092688160784384 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

cbor-java:FuzzDec: Security exception in co.nstant.in.cbor.CborDecoder.decodeNext

Detailed Report: https://oss-fuzz.com/testcase?key=6148494029815808 Project: cbor-java Fuzzing Engine: libFuzzer Fuzz Target: FuzzDec Job Type: libfuzzerasancbor-java Platform Id: linux Crash Type: Security exception Crash Address: Crash State: co.nstant.in.cbor.CborDecoder.decodeNext...

GO-2026-5684 Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime

Go-ipld-prime's DAG-CBOR and DAG-JSON decoders have unbounded recursion depth in github.com/ipld/go-ipld-prime...

CVE-2026-15957

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

CVE-2026-15957

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

CVE-2026-15957: Allocation of Resources Without Limits or Throttling

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. Uncontrolled recursion in the JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-...

jsoncons:fuzz_cbor_parser_max: Heap-buffer-overflow in jsoncons::cbor::basic_cbor_parser<jsoncons::stream_source<unsigned char, std::__

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5246852585553920 Project: jsoncons Fuzzing Engine: honggfuzz Fuzz Target: fuzzcborparsermax Job Type: honggfuzzasanjsoncons Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash...

jsoncons:fuzz_cbor: Heap-buffer-overflow in jsoncons::cbor::basic_cbor_parser<jsoncons::stream_source<unsigned char, std::__

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=5082885028380672 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzcbor Job Type: libfuzzerasanjsoncons Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address:...

GO-2026-5073 DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime

DAG-CBOR decoder unbounded memory allocation from CBOR headers in github.com/ipld/go-ipld-prime...

PYSEC-2026-282 APScheduler's JSONSerializer and CBORSerializer are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization

The JSONSerializer and CBORSerializer in APScheduler all versions including 3.10.x and 4.0.0a5 are vulnerable to Remote Code Execution RCE via Insecure Deserialization. The unmarshalobject function allows for arbitrary class instantiation and state injection by dynamically importing modules and...

ROOT-APP-MAVEN-CVE-2020-28491 CVE-2020-28491 in io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-cbor - Patched by Root

Root has patched CVE-2020-28491 in the io.root.com.fasterxml.jackson.dataformat:jackson-dataformat-cbor package for Root:Maven. Multiple fixed versions available...

jsoncons:fuzz_cbor_encoder: Heap-use-after-free in jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=4834232383111168 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzcborencoder Job Type: libfuzzerasanjsoncons Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash...

jsoncons:fuzz_cbor_encoder: Bad-cast to jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned char>, std::allocator<char>> from invalid vptr in jsoncons::cbor::cbor_mdarray_row_major_iterator<jsoncons::stream_source<unsigned

Project: https://github.com/danielaparker/jsoncons.git Detailed Report: https://oss-fuzz.com/testcase?key=4549385555083264 Project: jsoncons Fuzzing Engine: libFuzzer Fuzz Target: fuzzcborencoder Job Type: libfuzzerubsanjsoncons Platform Id: linux Crash Type: Bad-cast Crash Address: 0x5b1f102138e...