# CVE-2025-68131: agronholm cbor2 information disclosure via decoder reuse

Source: https://junglewise.ai/threats/cve-2025-68131-agronholm-cbor2-information-disclosure-via-decoder-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-31. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2025-68131 · Severity: medium · CVSS 4 · Published 2025-12-31

A vulnerability in the cbor2 Python library allows sensitive data to leak between different messages processed by the same decoder. If an application reuses a decoder to process data from multiple users, a malicious user could craft a message that references and retrieves data from a previous user's message. This could lead to the exposure of private information like credentials or tokens.

Technologies: [cbor2 (PyPI)](https://junglewise.ai/threats/technologies/cbor2). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-68131 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-68131 being exploited in the wild.

**How severe is CVE-2025-68131?** Medium severity, with a CVSS score of 4, published 31 December 2025.

**Which products and versions are affected?** cbor2 (PyPI) >= 3.0.0, < 5.8.0, ECOSYSTEM:introduced=3.0.0,fixed=5.8.0.

**Is there a fix for CVE-2025-68131?** Yes. cbor2 (PyPI): upgrade to 5.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-68131 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-68131?** Check whether you run cbor2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- cbor2 (PyPI): upgrade to 5.8.0 or later

  ```sh
  pip install "cbor2>=5.8.0"
  ```


## Technical details

A vulnerability exists in cbor2 where the CBORDecoder (both C and Python implementations) fails to clear the 'shareables' list when reused across multiple decode operations. This list stores values tagged with CBOR tag 28 (shareable). An attacker can send a crafted CBOR message using tag 29 (sharedref) to reference and retrieve values stored in the shareables list from previously decoded messages. This occurs because the decoder's state persists when decode_from_bytes() is called or when the file pointer is updated. The issue is resolved in version 5.8.0 by implementing flags to reset shared state between top-level decode/encode calls.

## Affected products

- agronholm cbor2 >= 3.0.0, < 5.8.0

## Identifiers

- CVE-2025-68131
- GHSA-wcj4-jw5j-44wh
- PYSEC-2025-90

## Timeline

- 2025-12-30: disclosed
- 2025-12-31: advisory: GHSA-wcj4-jw5j-44wh published
- 2025-12-31: patched: Version 5.8.0 released

## References

- [https://api.github.com/users/andreer](https://api.github.com/users/andreer)
- [https://github.com/andreer](https://github.com/andreer)
- [https://api.github.com/users/andreer/gists%7B/gist_id%7D](https://api.github.com/users/andreer/gists%7B/gist_id%7D)
- [https://api.github.com/users/andreer/repos](https://api.github.com/users/andreer/repos)
- [https://avatars.githubusercontent.com/u/264780?v=4](https://avatars.githubusercontent.com/u/264780?v=4)
- [https://api.github.com/users/andreer/events%7B/privacy%7D](https://api.github.com/users/andreer/events%7B/privacy%7D)

## Related threats

- [cbor2 denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-26209-cbor2-denial-of-service-via-uncontrolled-recursion)
- [cbor2 C extension integer underflow and memory leak in decoder](https://junglewise.ai/threats/cve-2025-64076-cbor2-c-extension-integer-underflow-and-memory-leak-in-decoder)
- [CBOR2 buffer overflow in decoder](https://junglewise.ai/threats/cve-2024-26134-cbor2-buffer-overflow-in-decoder)