msgpack vulnerabilities
CVEs whose affected-version data names the msgpack package (go, pip, rubygems). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-114613High· 7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
▾ Twilightmsgpack · msgpackEPSS 0.44%via OSV
CVE-2026-54522LowMessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
▾ Sunlitmsgpack · msgpackEPSS 0.23%via GHSA
GHSA-6v7p-g79w-8964High· 7.5MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
▾ Twilightmsgpack · msgpackvia GHSA
CVE-2026-32284High· 7.5PoCThe msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8)
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
▾ Midnightshamaton · msgpackEPSS 0.42%via NVD