Memory Persistence Issue in cbor2 Affects Multiple Versions
CVE-2025-68131

5.5MEDIUM

Key Information:

Vendor

Agronholm

Status
Cbor2
Vendor
CVE Published:
31 December 2025

What is CVE-2025-68131?

The cbor2 library, which facilitates encoding and decoding for the Concise Binary Object Representation (CBOR), has a significant vulnerability affecting versions 3.0.0 through 5.7.0. When a CBORDecoder instance is reused across multiple decoding operations, it can lead to memory values marked with the shareable tag (28) persisting. This can result in attacker-controlled messages being able to access previously decoded data when the decoder is used across different trust boundaries. The issue has been addressed in version 5.8.0, which is recommended for all users to mitigate potential risks.

Affected Version(s)

cbor2 >= 3.0.0, < 5.8.0

References

https://github.com/agronholm/cbor2/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/agronholm/cbor2/pull/268
x_refsource_MISC

CVSS V4

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.