EUVD-2026-108280

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth...

CVE-2026-114613 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth...

CVE-2026-114613

The msgpack-python C extension (msgpack._cmsgpack) contains an unbounded memory leak in versions prior to 1.2.3 . When deserializing data with strict_map_key=True (the default), the extension fails to release decoded map values upon key validation failure. This vulnerability affects both unpackb(...

aam-annotator (0.1.0), adarnauth-esi (>=1.4.1, <=1.4.14) +321 more potentially affected by CVE-2026-57585 via msgpack-python (>=0.4.2, <=0.5.6)

msgpack-python PYPI version =0.4.2, =1.4.1, =1.0.0, =0.9.1, =1.0.0, =0.0.3, =0.1.2, =2.0.0b2, =0.2.0, =0.1.0, =1.0.0, =0.0.1, =0.2.0 - arxlang 0.2.0 and more Source cves: CVE-2026-57585 Source advisory: MEND:CVE-2026-57585...

Use After Free

Overview msgpack is an efficient binary serialization format. Affected versions of this package are vulnerable to Use After Free in the unpacker' when it is reused after an error has occurred. An attacker can cause a crash or denial of service by repeatedly triggering errors and reusing the same...