Upstream information

CVE-2025-64076 at MITRE

Description

Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 - buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401): The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1.

SUSE information

Overall state of this security issue: Pending

This issue is currently rated as having important severity.

CVSS v3 Scores
CVSS detail CNA (MITRE) SUSE
Base Score 7.5 7.1
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:H
Attack Vector Network Local
Attack Complexity Low Low
Privileges Required None None
User Interaction None Required
Scope Unchanged Changed
Confidentiality Impact None Low
Integrity Impact None None
Availability Impact High High
CVSSv3 Version 3.1 3.1
CVSS v4 Scores
CVSS detail SUSE
Base Score 5.2
Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:H/SC:L/SI:N/SA:N
Attack Vector Local
Attack Complexity Low
Attack Requirements None
Privileges Required Low
User Interaction Passive
Vulnerable System Confidentiality Impact Low
Vulnerable System Integrity Impact None
Vulnerable System Availability Impact High
Subsequent System Confidentiality Impact Low
Subsequent System Integrity Impact None
Subsequent System Availability Impact None
CVSSv4 Version 4.0
SUSE Bugzilla entry: 1253746 [IN_PROGRESS]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
Container suse/sl-micro/6.0/base-os-container:latest
Container suse/sl-micro/6.1/base-os-container:2.2.0-4.26
Image SL-Micro
Image SL-Micro-Azure
Image SL-Micro-BYOS-Azure
Image SL-Micro-BYOS-EC2
Image SL-Micro-BYOS-GCE
Image SL-Micro-Base
Image SL-Micro-Base-RT
Image SL-Micro-Base-RT-SelfInstall
Image SL-Micro-Base-RT-encrypted
Image SL-Micro-Base-SelfInstall
Image SL-Micro-Base-encrypted
Image SL-Micro-Base-qcow
Image SL-Micro-Default
Image SL-Micro-Default-SelfInstall
Image SL-Micro-Default-encrypted
Image SL-Micro-Default-qcow
Image SL-Micro-EC2
Image SLE-Micro
Image SLE-Micro-Azure
Image SLE-Micro-BYOS
Image SLE-Micro-BYOS-Azure
Image SLE-Micro-BYOS-EC2
Image SLE-Micro-BYOS-GCE
Image SLE-Micro-EC2
Image SLE-Micro-GCE
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2
Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE
Image SUSE-Multi-Linux-Manager-Server-Azure-llc
Image SUSE-Multi-Linux-Manager-Server-Azure-ltd
Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure
Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2
Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE
Image SUSE-Multi-Linux-Manager-Server-EC2-llc
Image SUSE-Multi-Linux-Manager-Server-EC2-ltd
  • gettext-runtime >= 0.21.1-slfo.1.1_2.1
  • libtextstyle0 >= 0.21.1-slfo.1.1_2.1
SUSE Linux Enterprise Server 16.0
SUSE Linux Enterprise Server for SAP applications 16.0
  • python313-cbor2 >= 5.6.5-160000.3.1
 Patchnames:
SUSE-SLES-16.0-91
openSUSE Leap 16.0
  • python313-cbor2 >= 5.6.5-160000.3.1
 Patchnames:
openSUSE-Leap-16.0-91

List of packages in QA

Product(s) Package(s)
SUSE Linux Enterprise Server 16.0
  • python313-cbor2 >= 5.6.5-160000.3.1

Status of this issue by product and package

Please note that this evaluation state might be work in progress, incomplete or outdated. Also information for service packs in the LTSS phase is only included for issues meeting the LTSS criteria. If in doubt, feel free to contact us for clarification. The updates are grouped by state of their lifecycle. SUSE product lifecycles are documented on the lifecycle page.

Product(s) Source package State
Products under general support and receiving all security fixes.
SUSE Linux Enterprise Server 16.0 python-cbor2 In progress
SUSE Linux Enterprise Server for SAP applications 16.0 python-cbor2 Released

SUSE Timeline for this CVE

CVE page created: Tue Nov 18 20:04:20 2025
CVE page last modified: Thu Dec 11 18:12:31 2025