Medium · published December 31, 2025
⚠️ A sneaky memory leak is hiding in cbor2 versions 3.0.0 through 5.7.9! When a CBORDecoder is reused, it can spill the beans on previously decoded data like a chatty neighbor sharing secrets. 📢 Imagine a café where the barista keeps the last customer's order written down and uses it to make drinks for the next customer. If that order contained sensitive information, the next one might get something they shouldn't! An attacker can exploit this flaw by crafting malicious messages that read sensitive data from previously decoded messages. This could lead to unauthorized access to confidential information, particularly if the CBORDecoder is used across different trust boundaries. Quite the concern!
Imagine a café where the barista keeps the last customer's order written down and uses it to make drinks for the next customer. If that order contained sensitive information, the next one might get something they shouldn't! This vulnerability occurs when a CBORDecoder instance is reused without properly clearing memory, allowing values marked with the shareable tag (28) to persist and be accessed through the sharedref tag (29).
An attacker can exploit this flaw by crafting malicious messages that read sensitive data from previously decoded messages. This could lead to unauthorized access to confidential information, particularly if the CBORDecoder is used across different trust boundaries. Quite the concern! Upgrade to cbor2 version 5.8.0 or later immediately to patch this issue. Additionally, ensure that decoder instances are not reused across different security contexts without resetting their state. Conduct an audit of any systems relying on CBORDecoder to ensure compliance. You've got this! Stay ahead by following these steps and keep your data safe. 🛡️