GO-2026-5757 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio

MinIO vulnerable to Path Traversal via msgpack Body in ReadMultiple Storage-REST Endpoint in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

cloudcix (>=0.2.136, <=0.2.144) potentially affected by CVE-2026-57585 via msgpack (0.5.4)

msgpack PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on msgpack and may be impacted: - cloudcix =0.2.136, =0.2.144 Source cves: CVE-2026-57585 Source advisory: OSV:GHSA-6V7P-G79W-8964...

acelerai (>=0.0.32, <=0.0.45), acelerai-staging (>=0.0.1, <=0.0.13) +605 more potentially affected by CVE-2026-57585 via msgpack (>=1.0.0rc1, <=1.2.0)

msgpack PYPI version =1.0.0rc1, =0.0.32, =0.0.1, =1.0.0, =0.1.31, =1.1.0, =0.1.1, =0.9.2, =2.6.0, =2.0.0, =2.0.1, =0.4.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-57585 Source advisory: OSV:GHSA-6V7P-G79W-8964...

Use After Free

Overview msgpack is an efficient binary serialization format. Affected versions of this package are vulnerable to Use After Free in the unpacker' when it is reused after an error has occurred. An attacker can cause a crash or denial of service by repeatedly triggering errors and reusing the same...

acapy-mydata-did-protocol (>=0.1.0, <=0.1.15), acapy-patched (>=0.5.6.dev0, <=0.5.6) +116 more potentially affected by CVE-2026-57585 via msgpack (0.6.2)

msgpack PYPI version 0.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on msgpack and may be impacted: - acapy-mydata-did-protocol =0.1.0, =0.5.6.dev0, =0.1.7, =1.0.0, =0.1.3, =2.0.3, =0.1.0, =3.0.0, =0.0.1, =0.3.0, =0.0.0, =18.12.0, =1.4.0, =19.9.27...

yy-spider (1.0.0) potentially affected by CVE-2026-57585 via msgpack (0.5.0)

msgpack PYPI version 0.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on msgpack and may be impacted: - yy-spider 1.0.0 Source cves: CVE-2026-57585 Source advisory: OSV:GHSA-6V7P-G79W-8964...

bktest (>=1.0.0, <=2.0.0), cereal-lazer (>=0.0.3, <=0.1.6) +8 more potentially affected by CVE-2026-57585 via msgpack (0.6.1)

msgpack PYPI version 0.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on msgpack and may be impacted: - bktest =1.0.0, =0.0.3, =0.2.0, =0.0.4, =0.0.2, =3.0.0rc1, =0.0.0, =1.0.6, =0.3.0, =0.4.7 Source cves: CVE-2026-57585 Source advisory:...

synapse (>=0.0.45, <=0.0.56) potentially affected by CVE-2026-57585 via msgpack (0.5.1)

msgpack PYPI version 0.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on msgpack and may be impacted: - synapse =0.0.45, =0.0.56 Source cves: CVE-2026-57585 Source advisory: OSV:GHSA-6V7P-G79W-8964...

acelerai (>=0.0.32, <=0.0.45), acelerai-staging (>=0.0.1, <=0.0.13) +605 more potentially affected by CVE-2026-57585 via msgpack (>=1.0.0rc1, <=1.2.0)

msgpack PYPI version =1.0.0rc1, =0.0.32, =0.0.1, =1.0.0, =0.1.31, =1.1.0, =0.1.1, =0.9.2, =2.6.0, =2.0.0, =2.0.1, =0.4.0, =0.1.0, =0.2.0 and more Source cves: CVE-2026-57585 Source advisory: SNYK:PYTHON-MSGPACK-17391445...

allennlp (>=0.2.2, <=0.8.3), auklet (>=0.6.0, <=1.1.0b108) +36 more potentially affected by CVE-2026-57585 via msgpack (0.5.6)

msgpack PYPI version 0.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on msgpack and may be impacted: - allennlp =0.2.2, =0.6.0, =1.3.1, =1.4.0, =1.3.2, =0.1.0, =2.0.0, =0.3.8, =0.0.1, =0.0.90, =0.1.0, =0.1.10, =1.13.0.dev1757972726,...

electron-rpc (0.0.4), guardata (>=0.0.2, <=0.1.0) +1 more potentially affected by CVE-2026-57585 via msgpack (0.6.0)

msgpack PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on msgpack and may be impacted: - electron-rpc 0.0.4 - guardata =0.0.2, =1.14.0rc3, =2.6.0 Source cves: CVE-2026-57585 Source advisory: OSV:GHSA-6V7P-G79W-8964...

acelerai (>=0.0.32, <=0.0.45), acelerai-staging (>=0.0.1, <=0.0.13) +605 more potentially affected by unknown CVE via msgpack (>=1.0.0rc1, <=1.2.0)

msgpack PYPI version =1.0.0rc1, =0.0.32, =0.0.1, =1.0.0, =0.1.31, =1.1.0, =0.1.1, =0.9.2, =2.6.0, =2.0.0, =2.0.1, =0.4.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: GHSA-6V7P-G79W-8964...

CVE-2026-42600

MinIO is a high-performance object storage system. From RELEASE.2022-07-24T01-54-52Z to before RELEASE.2026-04-14T21-32-45Z, A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a caller holding the cluster root JWT to read files from outside the configure...

CVE-2026-5740

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users v...

GHSA-W9M8-P4CC-4QJ9 Mattermost doesn't properly validate msgpack-encoded WebSocket frames before memory allocation

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users v...

CVE-2026-5740

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users v...

CVE-2026-5740

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users v...

PT-2026-42750

Name of the Vulnerable Software and Affected Versions Mattermost version 11.6.0 Mattermost version 11.5.3 Mattermost version 11.4.4 Mattermost version 10.11.14 Description An issue exists where msgpack-encoded WebSocket frames are not properly validated before memory allocation. This allows an...

Mattermost security vulnerabilities

Mattermost is an open-source collaboration platform developed by the American company Mattermost. Vulnerabilities exist in versions of Mattermost 11.6.0 and earlier 11.6.x series, as well as versions prior to 11.5.3 11.5.x series, 11.4.4 and earlier 11.4.x series, and 10.11.14 and earlier 10.11.x...

CVE-2026-5740: Memory Allocation with Excessive Size Value

Mattermost versions 11.6.x = 11.6.0, 11.5.x = 11.5.3, 11.4.x = 11.4.4, 10.11.x = 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory allocation which allows an unauthenticated remote attacker to crash the server process and cause a full service outage for all users v...