PyPI/cbor2 CVE-2025-68131: high 7.5, EPSS 0.46%

CBORDecoder reuse can leak shareable values across decode calls

Action: Upgrade cbor2 to 5.8.0 or later.

pip install cbor2==5.8.0

Affected

Fixed versions

Sources

• osv: GHSA-wcj4-jw5j-44wh
• nvd: CVE-2025-68131
• https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh
• https://github.com/agronholm/cbor2/pull/268
• https://github.com/agronholm/cbor2/commit/f1d701cd2c411ee40bb1fe383afe7f365f35abf0
• https://github.com/agronholm/cbor2
• https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2025-90.yaml

CVE-2025-68131 · published 2025-12-31T22:01:38Z · modified 2026-09-10T03:49:54.340848867Z · JSON