msgpack-python vulnerabilities

CVEs whose affected-version data names the msgpack-python package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-114613High· 7.5

yesterday

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). …

▾ Twilightmsgpack · msgpack-pythonvia CVEORG