CVE-2025-68131: agronholm cbor2
Vulnerability summary
CVE-2025-68131 is a high (CVSS 7.5) vulnerability in agronholm cbor2. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 31-12-2025PublishedVulnerability first disclosed.
- 02-01-2026Last modifiedVulnerability information updated.
Description
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.
CVSS metrics
8 scores · 6 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:PDiffers
- NVDNIST5.5MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · PypiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.46%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
-0.01 pp
From 0.47% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCbor2
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard10 products
- authentik< 2025.10.3-r2
- authentik-fips< 2025.10.3-r1
- authentik-go-server< 2025.10.3-r2
- localstack< 4.12.0-r1
- localstack-compat< 4.12.0-r1
Agronholm1 product
- cbor2≥ 3.0.0, < 5.8.0
Debian1 product
- cbor2All versions (No fix recorded) | < 5.8.0-1
Opensuse1 product
- python-cbor2&distro=openSUSE Tumbleweed< 5.8.0-2.1
PyPI1 product
- cbor2≥ 3.0.0, < 5.8.0
Ubuntu1 product
- cbor2All versions (No fix recorded)
6 vendors · 15 products
References
11 links- github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44whX Refsource CONFIRMWEBEVIDENCEREPORTAdvisoryExploitVendor Advisory
- github.com/agronholm/cbor2PACKAGE
