{"id":"CVE-2026-114613","title":"MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure","summary":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). …","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","cwe":["CWE-401"],"vendor":"msgpack","product":"msgpack-python","affected":["msgpack-python < 1.2.3"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T18:22:40.544Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114613","references":[{"url":"https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2","label":"https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2"},{"url":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","label":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141"},{"url":"https://github.com/msgpack/msgpack-python/releases/tag/v1.2.3","label":"https://github.com/msgpack/msgpack-python/releases/tag/v1.2.3"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T22:00:50.363Z","slug":"CVE-2026-114613","body":"## Overview\n\nMessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.\n\n## Affected\n\n- `msgpack-python < 1.2.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}