From 3aa613d4b3ec1ed78dcaf5577cea867309d228c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Gr=C3=B6nholm?= <alex.gronholm@nextday.fi>
Date: Sat, 21 Mar 2026 23:48:20 +0200
Subject: [PATCH] Upped the max_depth value to 400

CVE: CVE-2026-26209
Upstream-Status: Backport [https://github.com/agronholm/cbor2/commit/a7ac10d5cbb7a8622e8270c201a131ac2abc26c7]

Backport Changes:
- Omitted docs/versionhistory.rst after it failed to cherry-pick because
  Scarthgap 5.6.4 lacks the later release sections; all source and test
  changes are retained.

(cherry picked from commit a7ac10d5cbb7a8622e8270c201a131ac2abc26c7)
Signed-off-by: Devansh Patel <devanshp@cisco.com>
---
 cbor2/_decoder.py     | 6 +++---
 source/decoder.h      | 2 +-
 tests/test_decoder.py | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cbor2/_decoder.py b/cbor2/_decoder.py
index 024c403..cccd0ac 100644
--- a/cbor2/_decoder.py
+++ b/cbor2/_decoder.py
@@ -75,7 +75,7 @@ class CBORDecoder:
         str_errors: Literal["strict", "error", "replace"] = "strict",
         read_size: int = 1,
         *,
-        max_depth: int = 100,
+        max_depth: int = 400,
     ):
         """
         :param fp:
@@ -817,7 +817,7 @@ def loads(
     str_errors: Literal["strict", "error", "replace"] = "strict",
     read_size: int = 1,
     *,
-    max_depth: int = 100,
+    max_depth: int = 400,
 ) -> Any:
     """
     Deserialize an object from a bytestring.
@@ -866,7 +866,7 @@ def load(
     str_errors: Literal["strict", "error", "replace"] = "strict",
     read_size: int = 1,
     *,
-    max_depth: int = 100,
+    max_depth: int = 400,
 ) -> Any:
     """
     Deserialize an object from an open file.
diff --git a/source/decoder.h b/source/decoder.h
index c4ef1c1..2989fc1 100644
--- a/source/decoder.h
+++ b/source/decoder.h
@@ -6,7 +6,7 @@
 // Default readahead buffer size for streaming reads.
 // Set to 1 for backwards compatibility (no buffering).
 #define CBOR2_DEFAULT_READ_SIZE 1
-#define CBOR2_DEFAULT_MAX_DEPTH 100
+#define CBOR2_DEFAULT_MAX_DEPTH 400
 
 // Forward declaration for function pointer typedef
 struct CBORDecoderObject_;
diff --git a/tests/test_decoder.py b/tests/test_decoder.py
index 5a90adf..9e33ded 100644
--- a/tests/test_decoder.py
+++ b/tests/test_decoder.py
@@ -142,9 +142,9 @@ class TestMaximumDepth:
     def test_default(self, impl) -> None:
         with pytest.raises(
             impl.CBORDecodeError,
-            match="maximum container nesting depth \\(100\\) exceeded",
+            match="maximum container nesting depth \\(400\\) exceeded",
         ):
-            impl.loads(b"\x81" * 101 + b"\x80")
+            impl.loads(b"\x81" * 401 + b"\x80")
 
     def test_explicit(self, impl) -> None:
         with pytest.raises(