CVE-2025-68131 - CVE House
Back to Database
Status published Medium CVE-2025-68131

CBORDecoder reuse can leak shareable values across decode calls

Vulnerability Description

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-68131

Credits & Attribution

No credits recorded in the NVD database.

References

More from agronholm

View All →
CVE-2024-26134
CBOR2 decoder has potential buffer overflow
High 7.5

Affected Vendor

Affected Software

cbor2
Vulnerable Versions:
>= 3.0.0, < 5.8.0

Timeline

Official Publish: December 31st, 2025
Last Modified: January 2nd, 2026
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-212

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.