This release fixes a potential panic when decoding into a time.Time from a CBOR byte string, map, or array under certain conditions.
Not affected: standard CBOR time data (RFC 8949 tag 0 or tag 1), and decoders configured with timeTag = DecTagRequired.
Upgrading to v2.9.3 is recommended.
The panic stack trace was publicly reported on 2026-08-17, and the fix was released the same day. Fuzz testing was extended to cover this class of bug, and fuzzing of v2.9.3 is ongoing.
What's Changed
- Skip data item when decoding to time.Time fails under certain conditions by @fxamacker in https://github.com/fxamacker/cbor/pull/803
Full Changelog: https://github.com/fxamacker/cbor/compare/v2.9.2...v2.9.3