CVE-2019-25001: Serde Cbor Project Serde Cbor

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

An issue was discovered in the serde_cbor crate before 0.10.2 for Rust. The CBOR deserializer can cause stack consumption via nested semantic tags.

Affected products

• Serde Cbor Project Serde Cbor: before 0.10.2 (fixed in 0.10.2)

Published 2020-12-31. Last modified 2026-06-17.