Vulnerability in Agronholm Cbor2
CVE-2025-68131
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (37.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.005 · change: -0.000
Affected products
- Agronholm Cbor2 — versions >= 3.0.0, < 5.8.0
Weakness classification (CWE)
References
- github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh (Exploit, Vendor Advisory)
- github.com/agronholm/cbor2/pull/268 (Exploit, Patch)
Frequently asked questions
- What is CVE-2025-68131?
- CVE-2025-68131 is a high-severity vulnerability in Agronholm Cbor2, classified under Improper Removal of Sensitive Information Before Storage or Transfer. CVSS score: 7.5/10. Published 2025-12-31.
- How severe is CVE-2025-68131?
- High severity. CVSS v3 base score is 7.5 out of 10.