# CVE-2025-64076: cbor2: Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C...

CVE-2025-64076 is fixed in 6 products on 1 platform, first by DEBIAN-CVE-2025-64076, released November 18, 2025. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2025-64076
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0049
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 18, 2025

## Description

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 - buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401): The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | cbor2 Debian 14 | 5.7.1-1 | [DEBIAN-CVE-2025-64076](https://patchblox.com/security/data/fix/linux/debian-cve-2025-64076.md) | Nov 18, 2025 |
| Linux | python-cbor2 Fedora 43 | 5.6.5-8.fc43 | [FEDORA-2026-CD0BB7AC34](https://patchblox.com/security/data/fix/linux/fedora-2026-cd0bb7ac34.md) | Apr 11, 2026 |
| Linux | python-cbor2 opensuse-leap 16.0 | 5.6.5-160000.3.1 | [OPENSUSE-SU-2025:20133-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2025-20133-1.md) | Dec 2, 2025 |
| Linux | python-cbor2 sles 16.0 | 5.6.5-160000.3.1 | [SUSE-SU-2025:21168-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-21168-1.md) | Dec 2, 2025 |
| Linux | python-cbor2-debugsource Fedora 43 | 5.6.5-8.fc43 | [FEDORA-2026-CD0BB7AC34](https://patchblox.com/security/data/fix/linux/fedora-2026-cd0bb7ac34.md) | Apr 11, 2026 |
| Linux | python-cbor2-doc Fedora 43 | 5.6.5-8.fc43 | [FEDORA-2026-CD0BB7AC34](https://patchblox.com/security/data/fix/linux/fedora-2026-cd0bb7ac34.md) | Apr 11, 2026 |
| Linux | python3-cbor2 Fedora 43 | 5.6.5-8.fc43 | [FEDORA-2026-CD0BB7AC34](https://patchblox.com/security/data/fix/linux/fedora-2026-cd0bb7ac34.md) | Apr 11, 2026 |
| Linux | python3-cbor2-debuginfo Fedora 43 | 5.6.5-8.fc43 | [FEDORA-2026-CD0BB7AC34](https://patchblox.com/security/data/fix/linux/fedora-2026-cd0bb7ac34.md) | Apr 11, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.