Description
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| msgpack | msgpack-python | < 1.2.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-msgpack | No fix yet | — |
| Debian 13 | python-msgpack | No fix yet | — |
| Debian 12 | python-msgpack | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-msgpack | 1.2.3-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | datadog-agent-7.79 | 7.79.2-r32 | — |
| Wolfi rolling | mitmproxy | 12.3.1-r2 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.31.0-r7 | — |
| Wolfi rolling | py3.10-pip-base +5 | 26.2.2-r1 | — |
| Wolfi rolling | py3.10-pipenv +7 | No fix yet | — |
| Wolfi rolling | py3.11-pipenv +3 | 2026.10.6-r1 | — |
| Wolfi rolling | pypy-3.10 | 7.3.19-r26 | — |
| Wolfi rolling | superset-6.0 | 6.0.0-r26 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | msgpack | < 1.2.3 | 1.2.3 | GHSA-j586-36cw-2gc2 |