← All advisories

High severity7.5NVD Advisory· Published Dec 31, 2020· Updated Jun 17, 2026

CVE-2019-25001

CVE-2019-25001

Description

An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
serde_cborcrates.io	< 0.10.2	0.10.2

Affected products

3

rust/serde_cbordescription
ghsa-coords
pkg:cargo/serde_cbor
Range: < 0.10.2
Serde Cbor Project/Serde Cbor
cpe:2.3:a:serde_cbor_project:serde_cbor:*:*:*:*:*:*:*:*
Range: <0.10.2

Patches

Vulnerability mechanics

References

6

rustsec.org/advisories/RUSTSEC-2019-0025.htmlnvdExploitThird Party AdvisoryWEB
github.com/advisories/GHSA-xr7r-88qv-q7hmghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2019-25001ghsaADVISORY
github.com/pyfisch/cbor/commit/1aec4f9d71855dbfb223fa61ca60260400cc5d5fghsaWEB
github.com/pyfisch/cbor/pull/153ghsaWEB
github.com/pyfisch/cbor/releases/tag/v0.10.2ghsaWEB

News mentions

0

No linked articles in our index yet.