cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20468-1 advisory.

    - CVE-2025-68131: CBORDecoder reuse across trust boundaries can lead to leak of shareable values from     previous decode       calls via attacker-controlled messages (bsc#1255783).
    - CVE-2026-26209: uncontrolled recursion via crafted CBOR payloads can cause a denial of service     (bsc#1260367).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization
    format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused
    across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be
    accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled
    message to read data from previously decoded messages if the decoder is reused across trust boundaries.
    Version 5.8.0 patches the issue. (CVE-2025-68131)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization     format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused     across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be     accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled     message to read data from previously decoded messages if the decoder is reused across trust boundaries.
    Version 5.8.0 patches the issue. (CVE-2025-68131)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
305837	openSUSE 16 Security Update : python-cbor2 (openSUSE-SU-2026:20468-1)	Nessus	SuSE Local Security Checks	Local	medium
436533	SCA: security update for cbor2 (GHSA-wcj4-jw5j-44wh)	Tenable Cloud Security	SCA Checks	Local	medium
436533	SCA: security update for cbor2 (GHSA-wcj4-jw5j-44wh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
281501	Linux Distros Unpatched Vulnerability : CVE-2025-68131	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-68131

medium

Tenable Plugins

medium

medium

medium

medium