CVE-2025-68131: cbor2 Package Vulnerability Allows Information Leakage Through CBORDecoder Reuse
Summary
CVE-2025-68131: CBORDecoder reuse can leak shareable values across decode calls. Affects cbor2 versions >= 3.0.0, < 5.8.0. Fixed in 5.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The cbor2 package is a Python library used for encoding and decoding CBOR (Concise Binary Object Representation) data. It is designed to be efficient and easy to use, providing a straightforward interface for handling binary data structures. However, the cbor2 package is vulnerable to a specific issue where reusing a CBORDecoder instance across different decode operations can lead to information leakage, particularly when decoding messages from untrusted sources.
Vulnerability Detail
The vulnerability arises from the improper handling of shareable values in the CBORDecoder. When a CBORDecoder instance is reused, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent decode operations using the sharedref tag (29). This allows an attacker to craft a message that can read sensitive data from previously decoded messages. The issue exists in both the C extension and the pure Python decoder, where the shareables list is not cleared between decode operations, leading to potential information disclosure.
How To Fix
Latest published version: 6.1.5 as of 23 Oct 2026
pip install --upgrade "cbor2==6.1.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.8.0
This is the first release that contains the fix.
pip install --upgrade "cbor2==5.8.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid reusing a CBORDecoder instance across different trust boundaries. Instead, create a new CBORDecoder instance for each decode operation to ensure that shareable values do not persist across different messages. Here is an example of how to implement this:
import cbor2 from io import BytesIO
Create a new decoder for each decode operation
decoder1 = cbor2.CBORDecoder(BytesIO(b'')) decoder1.decode_from_bytes(msg1)
decoder2 = cbor2.CBORDecoder(BytesIO(b'')) decoder2.decode_from_bytes(msg2)
Conclusion
The cbor2 package has a vulnerability (CVE-2025-68131) that can lead to information leakage when CBORDecoder instances are reused across different decode operations. It is crucial to update to the patched version (5.8.0 or later) and implement workarounds to protect sensitive data.
See every vulnerability recorded for cbor2 →
FAQ
CVE-2025-68131 is a vulnerability in the cbor2 package that allows information leakage through the reuse of CBORDecoder instances across different decode operations.
If your application reuses a CBORDecoder instance to decode messages from different sources, it may be vulnerable to information disclosure, allowing an attacker to access sensitive data from previously decoded messages.
You should update your cbor2 package to version 5.8.0 or later to mitigate the vulnerability. Use the command 'pip install --upgrade cbor2' to perform the update.
Yes, a temporary workaround is to avoid reusing a CBORDecoder instance across different trust boundaries. Create a new instance for each decode operation.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Vulert uses Pipfile.lock to track vulnerabilities without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for cbor2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
