CVE-2025-64076: cbor2 C extension integer underflow and memory leak in decoder

CVE-2025-64076 · Severity: high · CVSS 7.5 · Published 2025-11-18

cbor2 is a Python library for encoding and decoding CBOR (Concise Binary Object Representation) data, widely used in IoT, web APIs, and message queue systems. The library's C extension contains two flaws in the decoder that allow remote attackers to cause denial of service: one flaw triggers unlimited read operations that exhaust resources, while the other causes memory leaks when processing large payloads. Attackers can exploit both issues by sending specially crafted CBOR data without any authentication, potentially crashing applications or degrading performance.

Technologies: cbor2 (PyPI). Vendors: Agronholm, PyPI.

Quick answers

Is CVE-2025-64076 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-64076 being exploited in the wild.
How severe is CVE-2025-64076?
High severity, with a CVSS score of 7.5, published 18 November 2025.
Which products and versions are affected?
cbor2 (PyPI) < 5.7.1, ECOSYSTEM:introduced=0,fixed=5.7.1.
Is there a fix for CVE-2025-64076?
Yes. cbor2 (PyPI): upgrade to 5.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-64076 attacked?
It is attacked over the network.
Am I affected by CVE-2025-64076?
Check whether you run Agronholm Cbor2 or cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cbor2 (PyPI): upgrade to 5.7.1 or later
    pip install "cbor2>=5.7.1"

Technical details

The vulnerability exists in the decode_definite_long_string() function of cbor2's C extension decoder (source/decoder.c). Two distinct flaws are present: (1) Integer Underflow (CWE-191, CWE-125): An incorrect variable reference causes buffer_length to not be reset to zero after UTF-8 multi-byte character consumption at 65536-byte chunk boundaries. This causes subsequent chunk_length calculations to produce negative values (e.g., chunk_length = 65536 - buffer_length), which when passed as signed integers to the read() method triggers unlimited read operations (read(-1)), leading to resource exhaustion and CBORDecodeEOF exceptions. (2) Memory Leak (CWE-401): The loop processing CBOR string chunks fails to release Python object references (Py_DECREF) for chunk objects, causing cumulative memory leaks proportional to payload size for strings longer than 65536 bytes. Both flaws are exploitable remotely without authentication via specially crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at chunk boundaries. Fixed in version 5.7.1 and commit 851473490281f82d82560b2368284ef33cf6e8f9.

Affected products

  • agronholm cbor2 < 5.7.1

Identifiers

  • CVE-2025-64076
  • GHSA-9q9c-vjxh-p795
  • PYSEC-2025-238

Timeline

  • 2025-10-21: disclosed: Bug reported as issue #264 on GitHub
  • 2025-10-22: patched: Fix merged as PR #265
  • 2025-10-24: patched: Released in version 5.7.1
  • 2025-11-18: advisory: GitHub Advisory published (GHSA-9q9c-vjxh-p795, CVE-2025-64076)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.