Is CVE-2025-68131 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-68131 being exploited in the wild.

How severe is CVE-2025-68131?

Medium severity, with a CVSS score of 4, published 31 December 2025.

Which products and versions are affected?

cbor2 (PyPI) >= 3.0.0, < 5.8.0, ECOSYSTEM:introduced=3.0.0,fixed=5.8.0.

Is there a fix for CVE-2025-68131?

Yes. cbor2 (PyPI): upgrade to 5.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-68131 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-68131?

Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68131: agronholm cbor2 information disclosure via decoder reuse

Q: Is there a fix for CVE-2025-68131?

Yes. cbor2 (PyPI): upgrade to 5.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-68131 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2025-68131?

Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-68131 · Severity: medium · CVSS 4 · Published 2025-12-31

A vulnerability in the cbor2 Python library allows sensitive data to leak between different messages processed by the same decoder. If an application reuses a decoder to process data from multiple users, a malicious user could craft a message that references and retrieves data from a previous user's message. This could lead to the exposure of private information like credentials or tokens.

Technologies: cbor2 (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2025-68131 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-68131 being exploited in the wild.
How severe is CVE-2025-68131?: Medium severity, with a CVSS score of 4, published 31 December 2025.
Which products and versions are affected?: cbor2 (PyPI) >= 3.0.0, < 5.8.0, ECOSYSTEM:introduced=3.0.0,fixed=5.8.0.
Is there a fix for CVE-2025-68131?: Yes. cbor2 (PyPI): upgrade to 5.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-68131 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-68131?: Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

cbor2 (PyPI): upgrade to 5.8.0 or later
```
pip install "cbor2>=5.8.0"
```

Technical details

A vulnerability exists in cbor2 where the CBORDecoder (both C and Python implementations) fails to clear the 'shareables' list when reused across multiple decode operations. This list stores values tagged with CBOR tag 28 (shareable). An attacker can send a crafted CBOR message using tag 29 (sharedref) to reference and retrieve values stored in the shareables list from previously decoded messages. This occurs because the decoder's state persists when decode_from_bytes() is called or when the file pointer is updated. The issue is resolved in version 5.8.0 by implementing flags to reset shared state between top-level decode/encode calls.

Affected products

agronholm cbor2 >= 3.0.0, < 5.8.0

Identifiers

CVE-2025-68131
GHSA-wcj4-jw5j-44wh
PYSEC-2025-90

Timeline

2025-12-30: disclosed
2025-12-31: advisory: GHSA-wcj4-jw5j-44wh published
2025-12-31: patched: Version 5.8.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.