ETK-2026-3779Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-3779",
  "cve_id": null,
  "display_id": "ETK-2026-3779",
  "ghsa_id": "GHSA-6rgc-8hxm-rj7p",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Recursive denial of service in cbor2 CBORTag handling",
  "summary": "cbor2 6.x can construct self-referential CBORTag objects from attacker-controlled CBOR data. An attacker who can supply CBOR for decoding may crash the Python process during decoding in certain map or set cases, or when the application later hashes, compares, or formats the decoded value.",
  "mitigation": "Upgrade cbor2 to version 6.2.1. Until upgrades are deployed, do not decode untrusted CBOR where possible; enable strict_hashable_types=True to reduce decode-time crashes involving map keys and set elements, noting that it does not protect later operations on decoded cyclic tags.",
  "vendor": "pip",
  "product": "pip:cbor2",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">=6.0.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "6.2.1"
      ],
      "package_name": "cbor2",
      "purl": "pkg:pypi/cbor2"
    }
  ],
  "cwes": [
    674
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 8.734252866666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-11-07T00:23:29+00:00",
      "days": -1.0116151611921296,
      "is_lower_bound": true,
      "measured_at": "2026-11-08T00:40:12.730152+00:00",
      "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-6rgc-8hxm-rj7p"
    }
  }
}