p PatchFirst

CVE-2025-68131

CVE-2025-68131 · CBORDecoder reuse can leak shareable values across decode calls

This page contains facts from public vulnerability sources. Check the original advisory before updating.

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.

CVSS 5.5 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • cbor2

    Versions
    • >= 3.0.0, < 5.8.0: Affected

    No fix published

  • cbor2 Debian:12

    Versions
    • 5.4.6-1
    • 5.4.6-2
    • 5.5.1-1
    • 5.6.0-1
    • 5.6.1-1
    • 5.6.2-1
    • 5.6.3-1
    • 5.6.4-1
    • 5.6.5-1
    • 5.7.0-1
    • 5.7.1-1
    • 5.8.0-1
    • 5.8.0-2
    • 5.8.0-3
    • 5.9.0-1
    • 5.9.0-2
    • 5.9.0-2~bpo13+1
    • 5.9.0-2~bpo13+2
    • 6.1.2-1
    • 6.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Debian:13

    Versions
    • 5.6.5-1
    • 5.7.0-1
    • 5.7.1-1
    • 5.8.0-1
    • 5.8.0-2
    • 5.8.0-3
    • 5.9.0-1
    • 5.9.0-2
    • 5.9.0-2~bpo13+1
    • 5.9.0-2~bpo13+2
    • 6.1.2-1
    • 6.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Debian:14

    Versions
    • 5.6.5-1
    • 5.7.0-1
    • 5.7.1-1
    Affected ranges
    • ECOSYSTEM: < 5.8.0-1

    Update to 5.8.0-1

  • cbor2 PyPI

    Versions
    • 3.0.0
    • 3.0.1
    • 3.0.2
    • 3.0.3
    • 3.0.4
    • 4.0.0
    • 4.0.1
    • 4.1.0
    • 4.1.1
    • 4.1.2
    • 5.0.0
    • 5.0.1
    • 5.1.0
    • 5.1.1
    • 5.1.2
    • 5.2.0
    • 5.2.0.post1
    • 5.3.0
    • 5.4.0
    • 5.4.1
    • 5.4.2
    • 5.4.2.post1
    • 5.4.3
    • 5.4.4
    • 5.4.5
    • 5.4.6
    • 5.5.0
    • 5.5.1
    • 5.6.0
    • 5.6.1
    • 5.6.2
    • 5.6.3
    • 5.6.4
    • 5.6.5
    • 5.7.0
    • 5.7.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.0.0, < 5.8.0

    Update to 5.8.0

  • cbor2 Ubuntu:22.04:LTS

    Versions
    • 5.2.0-4
    • 5.2.0-4build1
    • 5.4.2-1
    • 5.4.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:24.04:LTS

    Versions
    • 5.4.6-2
    • 5.4.6-2build1
    • 5.5.1-1
    • 5.6.0-1
    • 5.6.1-1
    • 5.6.2-1
    • 5.6.2-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:25.10

    Versions
    • 5.6.5-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:26.10

    Versions
    • 5.8.0-2ubuntu1
    • 6.1.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • cbor2 Ubuntu:26.04:LTS

    Versions
    • 5.6.5-1build1
    • 5.7.0-1
    • 5.7.1-1
    • 5.8.0-1
    • 5.8.0-2ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →