PT-2025-54268 · Cbor2+1 · Cbor2+1

Andreer · Published 2025-01-01 · Updated 2026-04-08 · CVE-2025-68131

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions cbor2 versions 3.0.0 through 5.7.0

Description cbor2 is a library for encoding and decoding the Concise Binary Object Representation (CBOR) serialization format. A flaw exists where, when a CBORDecoder instance is reused across multiple decode operations, values tagged as shareable (tag 28) remain in memory. These values can then be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries.

Recommendations Update to version 5.8.0 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-212

Related Identifiers

AZL-73325

CVE-2025-68131

GHSA-WCJ4-JW5J-44WH

OPENSUSE-SU-2026:10014-1

OPENSUSE-SU-2026:20468-1

PYSEC-2025-90

SUSE-SU-2026:21139-1

Affected Products

Debian

Cbor2

References · 30

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68131.json · Exploit
• 🔥 https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh · Exploit
• https://github.com/agronholm/cbor2/pull/268 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-68131 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10014-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-68131 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-68131 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68131 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-90 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wcj4-jw5j-44wh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68131 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:21139-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-68131 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20468-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-68131 · Vendor Advisory