Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 - buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401): The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-71677aed1e advisory.

    Backport upstream patch for CVE-2025-64076

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-0afc953516 advisory.

    Backport upstream patch for CVE-2025-64076

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-cd0bb7ac34 advisory.

    Backport upstream patch for CVE-2025-64076

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20133-1 advisory.

    - CVE-2025-64076: Fixed bug in decode_definite_long_string() that causes incorrect chunk length     calculation (bsc#1253746).


    Already fixed in release 5.6.3:

    - CVE-2024-26134: Fixed potential crash when hashing a CBORTag (bsc#1220096).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string()     function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bounds     Read (CWE-191, CWE-125): An incorrect variable reference and missing state reset in the chunk processing     loop causes buffer_length to not be reset to zero after UTF-8 character consumption. This results in     subsequent chunk_length calculations producing negative values (e.g., chunk_length = 65536 -     buffer_length), which are passed as signed integers to the read() method, potentially triggering unlimited     read operations and resource exhaustion. (2) Memory Leak via Missing Reference Count Release (CWE-401):
    The main processing loop fails to release Python object references (Py_DECREF) for chunk objects allocated     in each iteration. For CBOR strings longer than 65536 bytes, this causes cumulative memory leaks     proportional to the payload size, enabling memory exhaustion attacks through repeated processing of large     CBOR payloads. Both vulnerabilities can be exploited remotely without authentication by sending specially-     crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at     65536-byte chunk boundaries. Successful exploitation results in denial of service through process crashes     (CBORDecodeEOF exceptions) or memory exhaustion. The vulnerabilities affect all applications using cbor2's     C extension to process untrusted CBOR data, including web APIs, IoT data collectors, and message queue     processors. Fixed in commit 851473490281f82d82560b2368284ef33cf6e8f9 pushed with released version 5.7.1.
    (CVE-2025-64076)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
310431	Fedora 44 : python-cbor2 (2026-71677aed1e)	Nessus	Fedora Local Security Checks	high
309740	Fedora 42 : python-cbor2 (2026-0afc953516)	Nessus	Fedora Local Security Checks	high
307694	Fedora 43 : python-cbor2 (2026-cd0bb7ac34)	Nessus	Fedora Local Security Checks	high
277556	openSUSE 16 Security Update : python-cbor2 (openSUSE-SU-2025-20133-1)	Nessus	SuSE Local Security Checks	high
275748	Linux Distros Unpatched Vulnerability : CVE-2025-64076	Nessus	Misc.	high

Detections

Analytics

CVE-2025-64076

high

Tenable Plugins

high

high

high

high

high