CVE-2026-57585High· 7.5▾ TwilightMessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
0.3% → 0.5%
Last analysed / modified upstream
If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.
If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.
v1.2.1
Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.
Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.
Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.
msgpack < 1.2.1Upgrade to a patched release:
msgpack 1.2.1Connected by shared product, vendor, weakness, or advisory.
GHSA-6v7p-g79w-8964High· 7.5MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
CVE-2026-54522LowMessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
CVE-2026-90473Medium· 5.3msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts
CVE-2026-90472Medium· 5.3msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits