CVE-2025-68131: 
Python vulnerability analysis and mitigation

CVE-2025-68131 is an information disclosure vulnerability in the Python cbor2 library titled "CBORDecoder reuse can leak shareable values across decode calls." When a CBORDecoder instance is reused across multiple decode operations, values marked with the CBOR shareable tag (28) persist in memory and can be accessed by subsequent messages using the sharedref tag (29), allowing an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. The vulnerability affects cbor2 versions 3.0.0 through 5.7.x (prior to 5.8.0) for Python. It was published on December 30–31, 2025, and patched in version 5.8.0. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 5.5 (Medium/Moderate) (Github Advisory, Security Advisory).

The root cause is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). The decoder maintains an internal shareables list to store values tagged with CBOR tag 28 for later reference by tag 29 (sharedref), as defined in the CBOR value sharing extension. When decode_from_bytes() is called or when .fp is set to a new stream, neither the C extension (_CBORDecoder_set_fp in source/decoder.c) nor the pure Python decoder (cbor2/_decoder.py) clears the shareables list, causing shareable values to persist across separate decode operations. An attacker who can send a crafted CBOR message containing a sharedref tag (e.g., cbor2.CBORTag(29, 0)) to a service that reuses a CBORDecoder instance can reference values from a prior trusted decode call, requiring no privileges or user interaction (Security Advisory, Github Advisory).

Successful exploitation results in information disclosure: an attacker can read sensitive data (such as credentials, tokens, or private user data) that was processed in earlier decode calls on the same CBORDecoder instance. The vulnerability has no impact on integrity or system availability in the primary attack scenario, though a related encoder bug could produce invalid CBOR leading to downstream denial of service or silent data corruption. The scope is limited to applications that reuse a CBORDecoder across trust boundaries where trusted messages use value sharing (tag 28) and an attacker can inject messages with sharedref tags (tag 29) (Security Advisory).

A public proof-of-concept is included in the official security advisory, demonstrating the exploit in a few lines of Python with no special configuration required. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.019% (0.000420), indicating a low near-term exploitation probability (Github Advisory, Security Advisory).

1. Identify a vulnerable target: Find a network-accessible service or application that uses cbor2 versions 3.0.0–5.7.x and reuses a single CBORDecoder instance to process CBOR messages from multiple sources or trust contexts.
2. Observe or infer trusted message structure: Determine that the trusted source sends CBOR messages containing values wrapped in the shareable tag (CBOR tag 28), which get stored in the decoder's shareables list.
3. Craft a malicious CBOR message: Construct a CBOR message containing a sharedref tag (CBOR tag 29) referencing the index of the desired shareable value (e.g., index 0 for the first shareable):

   import cbor2
   msg2 = cbor2.dumps(cbor2.CBORTag(29, 0))  # Reference index 0

4. Submit the crafted message: Send the attacker-controlled message to the target service after a trusted message containing a shareable value has been decoded by the same CBORDecoder instance.
5. Receive disclosed data: The decoder resolves the sharedref tag against its persistent shareables list and returns the sensitive value from the prior trusted decode operation (e.g., a secret string, credential, or token) (Security Advisory).

• Network: Unexpected or anomalous CBOR messages containing tag 29 (sharedref, byte prefix 0xd8 0x1d) submitted to application endpoints that process CBOR data, particularly from untrusted or external sources.
• Application Logs: Unusual decode results or data leakage in application logs where CBOR-decoded output contains values inconsistent with the current message's content; errors from downstream systems receiving malformed CBOR (related encoder bug).
• File System: No specific file artifacts expected; however, memory dumps of affected processes may show sensitive values persisting in the shareables list of CBORDecoder objects beyond their expected scope.

Upgrade cbor2 to version 5.8.0 or later, which resolves the issue by preventing shareable tag values from persisting across decoder reuse. If immediate upgrading is not possible, avoid reusing CBORDecoder instances across trust boundaries — instead, instantiate a new CBORDecoder for each decode operation, especially when processing messages from different sources. Red Hat has issued errata (RHSA-2026:5809, RHSA-2026:6761, RHSA-2026:6762) and Dell has issued DSA-2026-193 addressing this vulnerability in their products (Github Advisory, Security Advisory).

The vulnerability was reported by researcher andreer, who also submitted the fixing pull request and provided a detailed write-up in the GitHub security advisory. The fix was reviewed and merged by the cbor2 maintainer (agronholm) on December 29, 2025, with the advisory published the following day. The issue received coverage from security aggregators including Tenable (Nessus plugin 281501), Qualys, GitLab Advisories, and INCIBE-CERT, and was discussed briefly on Bluesky. A technical blog post was published at infinitsec.net covering the decoder reuse behavior (Security Advisory).