CVE-2025-64076: Agronholm Cbor2 DOS Vulnerability

CVE-2025-64076 Overview

Multiple vulnerabilities exist in the cbor2 Python library through version 5.7.0, specifically within the decode_definite_long_string() function of the C extension decoder (source/decoder.c). These vulnerabilities include an Integer Underflow Leading to Out-of-Bounds Read (CWE-191, CWE-125) and a Memory Leak via Missing Reference Count Release (CWE-401). The flaws stem from an incorrect variable reference and missing state reset in the chunk processing loop, causing buffer_length to not be reset to zero after UTF-8 character consumption. This results in subsequent chunk_length calculations producing negative values, which can trigger unlimited read operations and resource exhaustion. Additionally, the main processing loop fails to release Python object references for chunk objects, causing cumulative memory leaks when processing CBOR strings longer than 65536 bytes.

Critical Impact

Remote attackers can exploit these vulnerabilities without authentication by sending specially-crafted CBOR data, leading to denial of service through process crashes or memory exhaustion in web APIs, IoT data collectors, and message queue processors.

Affected Products

• agronholm cbor2 versions through 5.7.0
• Applications using cbor2's C extension to process untrusted CBOR data
• Web APIs, IoT data collectors, and message queue processors utilizing cbor2

Discovery Timeline

• 2025-11-18 - CVE CVE-2025-64076 published to NVD
• 2025-12-31 - Last updated in NVD database

Technical Details for CVE-2025-64076

Vulnerability Analysis

The vulnerabilities reside in the decode_definite_long_string() function within cbor2's C extension decoder. The root issue involves an incorrect variable reference where buffer_size is used instead of buffer_length in chunk length calculations. When processing definite-length text strings containing multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries, the buffer_length variable is not properly reset to zero after UTF-8 character consumption.

This creates a scenario where subsequent chunk_length calculations produce negative values (e.g., chunk_length = 65536 - buffer_length). Since these values are passed as signed integers to the read() method, this can trigger unlimited read operations, leading to resource exhaustion and CBORDecodeEOF exceptions.

The second vulnerability involves improper memory management where the main processing loop fails to call Py_DECREF on chunk objects allocated during each iteration. For CBOR strings exceeding 65536 bytes, this causes cumulative memory leaks proportional to payload size, enabling memory exhaustion attacks through repeated processing of large CBOR payloads.

Root Cause

The root cause is a variable naming error in the C extension decoder where buffer_size was incorrectly referenced instead of buffer_length during chunk length calculations. This incorrect reference, combined with missing state reset logic and missing Python reference count decrements, creates exploitable conditions for both denial of service and memory exhaustion attacks.

Attack Vector

The vulnerabilities can be exploited remotely without authentication by sending specially-crafted CBOR data containing definite-length text strings with multi-byte UTF-8 characters positioned at 65536-byte chunk boundaries. The attack requires network access to any application using cbor2's C extension to process untrusted CBOR data. Successful exploitation results in denial of service through either process crashes triggered by CBORDecodeEOF exceptions or memory exhaustion from cumulative memory leaks.

// Security patch from source/decoder.c
// Source: https://github.com/agronholm/cbor2/commit/851473490281f82d82560b2368284ef33cf6e8f9

     char *buffer = NULL;
     while (left) {
         // Read up to 65536 bytes of data from the stream
-        Py_ssize_t chunk_length = 65536 - buffer_size;
+        Py_ssize_t chunk_length = 65536 - buffer_length;
         if (left < chunk_length)
             chunk_length = left;

The fix corrects the variable reference from buffer_size to buffer_length, ensuring proper chunk length calculations and preventing negative values from being passed to the read operation.

Detection Methods for CVE-2025-64076

Indicators of Compromise

• Unexpected CBORDecodeEOF exceptions in application logs when processing CBOR data
• Abnormal memory growth in processes handling CBOR payloads exceeding 65536 bytes
• Process crashes during CBOR decoding operations involving multi-byte UTF-8 characters
• Elevated memory consumption patterns during CBOR data processing

Detection Strategies

• Monitor application logs for CBORDecodeEOF exceptions that may indicate exploitation attempts
• Implement memory usage monitoring for services processing CBOR data to detect memory leak patterns
• Deploy network traffic analysis to identify unusually large CBOR payloads targeting vulnerable endpoints
• Use dependency scanning tools to identify cbor2 versions prior to 5.7.1 in your environment

Monitoring Recommendations

• Establish baseline memory consumption metrics for CBOR processing services and alert on anomalies
• Configure application performance monitoring to track CBOR decoding operation times and failure rates
• Implement payload size limits for incoming CBOR data at the application layer
• Enable verbose logging for CBOR processing operations during security assessment periods

How to Mitigate CVE-2025-64076

Immediate Actions Required

• Upgrade cbor2 to version 5.7.1 or later immediately
• Audit all applications and services using cbor2 for processing untrusted CBOR data
• Implement input validation and size limits for CBOR payloads as a defense-in-depth measure
• Review and update dependency management configurations to prevent use of vulnerable versions

Patch Information

The vulnerability is fixed in cbor2 version 5.7.1, released in commit 851473490281f82d82560b2368284ef33cf6e8f9. The fix corrects the variable reference from buffer_size to buffer_length in the decode_definite_long_string() function. For detailed information, see the GitHub Pull Request and the GitHub Commit.

Workarounds

• Disable the C extension decoder and use the pure Python decoder if upgrading is not immediately possible
• Implement strict payload size validation before CBOR processing to limit exposure
• Deploy web application firewalls or input filters to reject oversized CBOR payloads
• Isolate services processing untrusted CBOR data in sandboxed environments with resource limits

# Upgrade cbor2 to the patched version
pip install --upgrade cbor2>=5.7.1

# Verify installed version
pip show cbor2 | grep Version

# For environments using requirements.txt, update the dependency
echo "cbor2>=5.7.1" >> requirements.txt
pip install -r requirements.txt