cbor2 vulnerabilities
CVEs whose affected-version data names the cbor2 package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2025-68131MediumCBORDecoder reuse can leak shareable values across decode calls
CBORDecoder reuse can leak shareable values across decode calls
▾ Sunlitcbor2 · cbor2EPSS 0.47%via OSV
CVE-2025-64076High· 7.5Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (s…
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorre…
▾ Twilightcbor2 · cbor2EPSS 0.46%via OSV