Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/39797?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/39797?format=api", "purl": "pkg:pypi/cbor2@5.5.1", "type": "pypi", "namespace": "", "name": "cbor2", "version": "5.5.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.8.0", "latest_non_vulnerable_version": "5.8.0", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/36727?format=api", "vulnerability_id": "VCID-t8n4-qcj9-sqg1", "summary": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) (RFC 8949) serialization format. Starting in version 5.5.1 and prior to version 5.6.2, an attacker can crash a service using cbor2 to parse a CBOR binary by sending a long enough object. Version 5.6.2 contains a patch for this issue.", "references": [ { "reference_url": "https://github.com/agronholm/cbor2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/agronholm/cbor2" }, { "reference_url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/agronholm/cbor2/commit/387755eacf0be35591a478d3c67fe10618a6d542" }, { "reference_url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/agronholm/cbor2/commit/4de6991ba29bf2290d7b9d83525eda7d021873df" }, { "reference_url": "https://github.com/agronholm/cbor2/pull/204", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/agronholm/cbor2/pull/204" }, { "reference_url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/agronholm/cbor2/releases/tag/5.6.2" }, { "reference_url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-375g-39jq-vq7m" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/cbor2/PYSEC-2024-155.yaml" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BT42VXZMMMCSSHMA65KKPOZCXJEYHNR5/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GX524ZG2XJWFV37UQKQ4LWIH4UICSGEQ/" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY", "reference_id": "", "reference_type": "", "scores": [], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY" }, { "reference_url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" } ], "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PWC3VU6YV6EXKCSX5GTKWLBZIDIJNQJY/" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134", "reference_id": "CVE-2024-26134", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-26134" }, { "reference_url": "https://github.com/advisories/GHSA-375g-39jq-vq7m", "reference_id": "GHSA-375g-39jq-vq7m", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-375g-39jq-vq7m" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/39800?format=api", "purl": "pkg:pypi/cbor2@5.6.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-wqk8-hznt-cbdt" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/cbor2@5.6.2" } ], "aliases": [ "CVE-2024-26134", "GHSA-375g-39jq-vq7m", "PYSEC-2024-155" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-t8n4-qcj9-sqg1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37177?format=api", "vulnerability_id": "VCID-wqk8-hznt-cbdt", "summary": "cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory and can be accessed by subsequent CBOR messages using the sharedref tag (29). This allows an attacker-controlled message to read data from previously decoded messages if the decoder is reused across trust boundaries. Version 5.8.0 patches the issue.", "references": [ { "reference_url": "https://github.com/agronholm/cbor2", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/agronholm/cbor2" }, { "reference_url": "https://github.com/agronholm/cbor2/commit/f1d701cd2c411ee40bb1fe383afe7f365f35abf0", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/agronholm/cbor2/commit/f1d701cd2c411ee40bb1fe383afe7f365f35abf0" }, { "reference_url": "https://github.com/agronholm/cbor2/pull/268", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/agronholm/cbor2/pull/268" }, { "reference_url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68131", "reference_id": "CVE-2025-68131", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68131" }, { "reference_url": "https://github.com/advisories/GHSA-wcj4-jw5j-44wh", "reference_id": "GHSA-wcj4-jw5j-44wh", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-wcj4-jw5j-44wh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/46947?format=api", "purl": "pkg:pypi/cbor2@5.8.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/cbor2@5.8.0" } ], "aliases": [ "CVE-2025-68131", "GHSA-wcj4-jw5j-44wh", "PYSEC-2025-90" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wqk8-hznt-cbdt" } ], "fixing_vulnerabilities": [], "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/cbor2@5.5.1" }