CVE-2025-64076
📋 TL;DR
Two vulnerabilities in cbor2's C extension allow remote attackers to cause denial of service through process crashes or memory exhaustion. Attackers can exploit these by sending specially crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters at specific boundaries. All applications using cbor2's C extension to process untrusted CBOR data are affected, including web APIs, IoT data collectors, and message queue processors.
💻 Affected Systems
- cbor2
📦 What is this software?
Cbor2 by Agronholm
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability through process crashes or memory exhaustion, potentially affecting multiple dependent services in a chain reaction.
Likely Case
Denial of service affecting the specific application processing malicious CBOR payloads, leading to service interruptions.
If Mitigated
Limited impact with proper input validation and resource limits, though vulnerable systems remain at risk of targeted attacks.
🎯 Exploit Status
Exploitation requires sending specially crafted CBOR data but is straightforward once the payload structure is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.7.1
Vendor Advisory: https://github.com/agronholm/cbor2/commit/851473490281f82d82560b2368284ef33cf6e8f9
Restart Required: Yes
Instructions:
1. Update cbor2 package: pip install --upgrade cbor2==5.7.1
2. Restart all applications using cbor2
3. Verify the update with: pip show cbor2
🔧 Temporary Workarounds
Disable C Extension
allForce use of pure Python implementation which is not vulnerable
export CBOR2_USE_C_EXTENSION=0
set CBOR2_USE_C_EXTENSION=0
Input Size Limiting
allLimit maximum CBOR payload size before processing
🧯 If You Can't Patch
- Implement strict input validation to reject CBOR strings longer than 65536 bytes
- Deploy network-level protections to filter or limit CBOR traffic to vulnerable systems
🔍 How to Verify
Check if Vulnerable:
Check cbor2 version: pip show cbor2 | grep VersionCheck Version:
pip show cbor2 | grep VersionVerify Fix Applied:
Verify version is 5.7.1 or higher: pip show cbor2 | grep Version📡 Detection & Monitoring
Log Indicators:
- CBORDecodeEOF exceptions
- Memory exhaustion errors
- Process crashes during CBOR parsing
Network Indicators:
- Unusually large CBOR payloads (>65KB)
- Multiple connection attempts with CBOR data
SIEM Query:
source="application.logs" AND ("CBORDecodeEOF" OR "memory exhaustion" OR "cbor2")