EUVD-2026-108280

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension msgpack.cmsgpack leaks a decoded map value when deserialization rejects a key with strictmapkey=True the default. Repeated malformed inputs can cause unbounded process memory growth...

CVE-2026-114613

The msgpack-python C extension (msgpack._cmsgpack) contains an unbounded memory leak in versions prior to 1.2.3 . When deserializing data with strict_map_key=True (the default), the extension fails to release decoded map values upon key validation failure. This vulnerability affects both unpackb(...