Junglewise Threat Intelligence

CVE-2025-64076: cbor2 C extension integer underflow and memory leak in decoder

CVE-2025-64076 · Severity: high · CVSS 7.5 · Published 2025-11-18

Technologies: Agronholm Cbor2. Vendors: PyPI.

Executive brief

cbor2 is a Python library for encoding and decoding CBOR (Concise Binary Object Representation) data, widely used in IoT, web APIs, and message queue systems. The library's C extension contains two flaws in the decoder that allow remote attackers to cause denial of service: one flaw triggers unlimited read operations that exhaust resources, while the other causes memory leaks when processing large payloads. Attackers can exploit both issues by sending specially crafted CBOR data without any authentication, potentially crashing applications or degrading performance.

Technical details

The vulnerability exists in the decode_definite_long_string() function of cbor2's C extension decoder (source/decoder.c). Two distinct flaws are present: (1) Integer Underflow (CWE-191, CWE-125): An incorrect variable reference causes buffer_length to not be reset to zero after UTF-8 multi-byte character consumption at 65536-byte chunk boundaries. This causes subsequent chunk_length calculations to produce negative values (e.g., chunk_length = 65536 - buffer_length), which when passed as signed integers to the read() method triggers unlimited read operations (read(-1)), leading to resource exhaustion and CBORDecodeEOF exceptions. (2) Memory Leak (CWE-401): The loop processing CBOR string chunks fails to release Python object references (Py_DECREF) for chunk objects, causing cumulative memory leaks proportional to payload size for strings longer than 65536 bytes. Both flaws are exploitable remotely without authentication via specially crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at chunk boundaries. Fixed in version 5.7.1 and commit 851473490281f82d82560b2368284ef33cf6e8f9.

Affected products

  • agronholm cbor2 < 5.7.1

Timeline

  • 2025-10-21: disclosed: Bug reported as issue #264 on GitHub
  • 2025-10-22: patched: Fix merged as PR #265
  • 2025-10-24: patched: Released in version 5.7.1
  • 2025-11-18: advisory: GitHub Advisory published (GHSA-9q9c-vjxh-p795, CVE-2025-64076)

References

Related threats