GHSA-wcj4-jw5j-44wh
NoneCVSS
—
EPSS
—
Published
Dec 31, 2025
CISA due date
—
The record
CBORDecoder reuse can leak shareable values across decode calls
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | cbor2 | 3.0.0 | 5.8.0 |
| Chainguard | authentik | 0 | 2025.10.3-r2 |
| Chainguard | authentik-fips | 0 | 2025.10.3-r1 |
| Chainguard | authentik-go-server | 0 | 2025.10.3-r2 |
| Chainguard | authentik-go-server-fips | 0 | 2025.10.3-r0 |
| Chainguard | localstack | 0 | 4.12.0-r1 |
| Chainguard | localstack-compat | 0 | 4.12.0-r1 |
| Chainguard | py3-vllm-cuda-12.4 | 0 | 0.13.0-r1 |
| Chainguard | py3.10-vllm-cuda-12.4 | 0 | 0.13.0-r1 |
| Chainguard | py3.12-vllm-cuda-12.4 | 0 | 0.13.0-r1 |
| Chainguard | tritonserver-backend-vllm-cuda-12.9 | 0 | 25.9.0_git20251112-r4 |
| Chainguard | tritonserver-backend-vllm-meta-cuda-12.9 | 0 | 25.9.0_git20251112-r4 |
| pypi | cbor2 | 3.0.0 | No fix |
Related vulnerabilities
- CVE-2025-68131 CBORDecoder reuse can leak shareable values across decode calls Same vulnerability
- CVE-2026-30922 pyasn1 is a generic ASN.1 library for Python. Also affects authentik
- CVE-2026-27448 pyOpenSSL is a Python wrapper around the OpenSSL library. Also affects authentik
- CVE-2026-27459 pyOpenSSL is a Python wrapper around the OpenSSL library. Also affects authentik
- CVE-2026-32597 PyJWT is a JSON Web Token implementation in Python. Also affects authentik
- CVE-2026-26007 cryptography is a package designed to expose cryptographic primitives and recipes to… Also affects authentik
- GHSA-6426-9fv3-65x8 Django has an SQL Injection issue Also affects authentik
- GHSA-gvg8-93h5-g6qq Django has an SQL Injection issue Also affects authentik