CVE-2026-106972

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-106971

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-128253

An uncontrolled recursion in the MessagePackBufferUnpacker::unpack component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-106971

The rybakit/msgpack library, specifically version v0.11.0 , is vulnerable to an integer overflow within the MessagePack\BufferUnpacker component. This flaw can be triggered by processing a crafted input , potentially allowing an attacker to cause a Denial of Service (DoS) . No specific remediatio...

EUVD-2026-112134

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-106972

The rybakit/msgpack library, version v0.11.0 , is vulnerable to a Denial of Service (DoS) due to an uncontrolled recursion within the MessagePack\BufferUnpacker::unpack() component. An attacker can trigger this condition by providing a crafted input . No specific remediation steps or exploit deta...

EUVD-2026-112133

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-106972

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-106971

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2026-128252

An integer overflow in the MessagePackBufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

msgpack-CVE-2021-23410-test

Test for https://snyk.io/vuln/SNYK-JS-MSGPACK-1296122 This looks like not vulerbility. var assert = require'assert'; var msgpack = require'msgpack'; function sleepms return new Promiseresolve = setTimeoutresolve, ms; ; async function init var normal = "a": 1, "b": 2, "c": 1, 2, 3 ; var malicious ...

security-advisories

Security Advisories Public technical advisories for vulnerabi...

EUVD-2026-108280

MessagePack: Unbounded memory leak in msgpack C extension on strictmapkey validation failure...

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

Impact The msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled...

GHSA-J586-36CW-2GC2 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

Impact The msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled...

SUSE CVE-2026-114613

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth...

CVE-2026-93849

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a...

CVE-2026-93849 Mattermost allows authenticated users to trigger excessive memory allocation via crafted msgpack binary WebSocket frames

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a...

CVE-2026-93849

The Mattermost messaging platform (versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x

EUVD-2026-109937

Mattermost versions 11.9.x = 11.9.1, 11.8.x = 11.8.5, 11.7.x = 11.7.10, 11.10.x = 11.10.1 Mattermost fail to apply allocation limits to the byte-string decode paths in its WebSocket msgpack decoder, which allows an authenticated remote attacker to cause excessive server memory allocation via a...