CVE-2025-68131 CBORDecoder reuse can leak shareable values across decode calls

cbor2 provides encoding and decoding for the Concise Binary Object Representation CBOR serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag 28 persist in memory an...

cbor2 安全漏洞

cbor2 is a library with extensive tag support for encoding and decoding binary object representations in serialized format from the individual developer Alex Grönholm. A security vulnerability exists in cbor2 version 3.0.0 up to and including version 5.8.0, which stems from the fact that when the...

Linux Distros Unpatched Vulnerability : CVE-2025-68131

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cbor2 provides encoding and decoding for the Concise Binary Object Representation CBOR serialization format. Starting in version 3.0.0 and prior to version 5.8....

SUSE: Security Advisory (SUSE-SU-2025:21168-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 16 Security Update : python-cbor2 (openSUSE-SU-2025-20133-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20133-1 advisory. - CVE-2025-64076: Fixed bug in decodedefinitelongstring that causes incorrect chunk length calculation bsc1253746. Already fixed in release 5.6....

Security update for python-cbor2 (important)

openSUSE security update: security update for python-cbor2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2025-20133-1 Rating: important References: bsc1220096 bsc1253746 Cross-References: CVE-2024-26134 CVE-2025-64076 CVSS scores: CVE-2025-64076 SUSE :...

SUSE-SU-2025:21168-1 Security update for python-cbor2

This update for python-cbor2 fixes the following issues: - CVE-2025-64076: Fixed bug in decodedefinitelongstring that causes incorrect chunk length calculation bsc1253746. Already fixed in release 5.6.3: - CVE-2024-26134: Fixed potential crash when hashing a CBORTag bsc1220096...

OPENSUSE-SU-2025:20133-1 Security update for python-cbor2

This update for python-cbor2 fixes the following issues: - CVE-2025-64076: Fixed bug in decodedefinitelongstring that causes incorrect chunk length calculation bsc1253746. Already fixed in release 5.6.3: - CVE-2024-26134: Fixed potential crash when hashing a CBORTag bsc1220096...

CVE-2025-64076

A flaw was found in cbor2. This vulnerability allows denial of service through process crashes or memory exhaustion via sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters...

SUSE CVE-2025-64076

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer Underflow Leading to Out-of-Bounds Read CWE-191, CWE-125: An incorrect variable reference and missing state reset in the chunk processing...

ai-box-lib (>=0.1.0 <=0.2.1), aligned-py (>=0.1.0 <=0.2.0a0) +70 more potentially affected by CVE-2025-64076 via cbor2 (>=5.0.1 <=5.7.0)

cbor2 PYPI version =5.0.1, =0.1.0, =0.1.0, =0.13.0, =0.5.5.post5, =0.5.5.post4, =0.1.0, =2.0.1, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.1.4 and more Source cves: CVE-2025-64076 Source advisory: SNYK:PYTHON-CBOR2-14049181...

Missing Release of Memory after Effective Lifetime

Overview cbor2 is a CBOR deserializer with extensive tag support Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the decodedefinitelongstring function in source/decoder.c file An attacker can cause process crashes or exhaust system memory...

CVE-2025-64076

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer Underflow Leading to Out-of-Bounds Read CWE-191, CWE-125: An incorrect variable reference and missing state reset in the chunk processing...

AZL-70516 CVE-2025-64076 affecting package python-cbor2 5.6.5-2

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer Underflow Leading to Out-of-Bounds Read CWE-191, CWE-125: An incorrect variable reference and missing state reset in the chunk processing...

PYSEC-2025-238

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer Underflow Leading to Out-of-Bounds Read CWE-191, CWE-125: An incorrect variable reference and missing state reset in the chunk processing...

UBUNTU-CVE-2025-64076

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer Underflow Leading to Out-of-Bounds Read CWE-191, CWE-125: An incorrect variable reference and missing state reset in the chunk processing...

Linux Distros Unpatched Vulnerability : CVE-2025-64076

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer...

PT-2025-47374

Name of the Vulnerable Software and Affected Versions cbor2 versions through 5.7.0 Description The cbor2 software contains issues in the decode definite long string function within the C extension decoder source/decoder.c. An integer underflow can lead to an out-of-bounds read, and a memory leak...

CVE-2025-64076

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decodedefinitelongstring function of the C extension decoder source/decoder.c: 1 Integer Underflow Leading to Out-of-Bounds Read CWE-191, CWE-125: An incorrect variable reference and missing state reset in the chunk processing...

cbor2 安全漏洞

cbor2 is a library with extensive tag support for encoding and decoding binary object representations in serialized format by the individual developer Alex Grönholm. A security vulnerability exists in cbor2 version 5.7.0 and earlier, which stems from an integer overflow and memory leak in the...