Vulnerability in Agronholm Cbor2
CVE-2025-68131
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.
EPSS: 0.004 (34.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Agronholm Cbor2 — versions >= 3.0.0, < 5.8.0
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
- security-advisories@github.com (Exploit, Patch, x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-68131?
- CVE-2025-68131 is a high-severity vulnerability in Agronholm Cbor2, classified under Improper Removal of Sensitive Information Before Storage or Transfer. CVSS score: 7.5/10. Published 2025-12-31.
- How severe is CVE-2025-68131?
- High severity. CVSS v3 base score is 7.5 out of 10.