CVE-2025-68131
High
Description
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.
SeverityHigh
CVSS7.5
Exploit probability—
ProductAgronholm Cbor2
PublishedDec 31, 2025
First seenDec 31, 2025
Weakness typeCWE-212CWE-212
How to fix
Update
- agronholm cbor25.8.0 or later
- cbor25.8.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| agronholm cbor2 | 3.0.0 ≤ v < 5.8.0 | 5.8.0 |
| cbor2PyPI | 3.0.0 ≤ v < 5.8.0 | 5.8.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.