Your message dated Sat, 24 Oct 2026 15:06:42 +0000
with message-id <[email protected]>
and subject line Bug#1151844: fixed in python-msgpack 1.2.1-2
has caused the Debian Bug report #1151844,
regarding python-msgpack: CVE-2026-114613
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1151844: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151844
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: python-msgpack
Version: 1.2.1-1
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for python-msgpack.
CVE-2026-114613[0]:
| MessagePack is the serializer implementation for Python msgpack.org.
| Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack)
| leaks a decoded map value when deserialization rejects a key with
| strict_map_key=True (the default). Repeated malformed inputs can
| cause unbounded process memory growth and denial of service in
| applications that deserialize attacker-controlled MessagePack data.
| Both unpackb() and the streaming Unpacker API are affected. The
| pure-Python fallback does not exhibit this leak in the reported
| tests. This issue is fixed in version 1.2.3.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-114613
https://www.cve.org/CVERecord?id=CVE-2026-114613
[1]
https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2
[2]
https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: python-msgpack
Source-Version: 1.2.1-2
Done: Thomas Goirand <[email protected]>
We believe that the bug you reported is fixed in the latest version of
python-msgpack, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Thomas Goirand <[email protected]> (supplier of updated python-msgpack package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Oct 2026 16:42:02 +0200
Source: python-msgpack
Architecture: source
Version: 1.2.1-2
Distribution: unstable
Urgency: high
Maintainer: Debian OpenStack <[email protected]>
Changed-By: Thomas Goirand <[email protected]>
Closes: 1151844
Changes:
python-msgpack (1.2.1-2) unstable; urgency=high
.
* CVE-2026-114613: unbounded memory leak in the C extension on
strict_map_key validation failure (DoS with attacker-controlled
input), plus use-after-free when resuming the streaming Unpacker
after an error. Applied upstream patches (Closes: #1151844):
- CVE-2026-114613-fix-memory-leak-on-strict-map-key-rejection.patch
- fix-Unpacker-reentrant-feed-guard.patch
- fix-unpackb-use-after-free-ExtraData-non-contiguous-input.patch
- CVE-2026-114613-add-regression-tests.patch
Checksums-Sha1:
c0e8f681ed6592cf99c9f5cae9462fe418caf31f 2225 python-msgpack_1.2.1-2.dsc
988d79ff97706efa9f74d9bc1de2ffe968bce8e5 11896
python-msgpack_1.2.1-2.debian.tar.xz
d1d2d8e63edf55443577694b77897c9e1e140aac 7647
python-msgpack_1.2.1-2_amd64.buildinfo
Checksums-Sha256:
bb61eeaf17e5073120e6ce492027123ffc889af017d864234262e6bbb1301835 2225
python-msgpack_1.2.1-2.dsc
f4dde3eb4909c679e9dccc0b8bb701405244eb91dbfe23d8f0798f4c98fcae8b 11896
python-msgpack_1.2.1-2.debian.tar.xz
bf3faedec2867a4123e08a08e35fa467c09a2e142a512ecb11e9d8a0fd7ca431 7647
python-msgpack_1.2.1-2_amd64.buildinfo
Files:
dc8b50a255a9b6a7715e5e46dfd0f836 2225 python optional
python-msgpack_1.2.1-2.dsc
540e0348a32aab21d3f65b6f54350d45 11896 python optional
python-msgpack_1.2.1-2.debian.tar.xz
51a2a868b2bc987d9b75a4ead0e7a1fc 7647 python optional
python-msgpack_1.2.1-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrcxmYACgkQ1BatFaxr
Q/4I+Q/+PSHPIVFkxo+Oy9YV+l1UhTkrSmnE42aA5kaIM4YHZvSt0w4cCV0s4Si+
utO9OiivRX48hQL7xXu9vWEhjEbs4zSQTB8gxmseB/yF7euSm6jYOk7+VYN3JTgP
u+0U5PYkaOMDcPyt4NwrxuERHTe+sMeHcTN7Hjimq8Kj/AsLHmK3jy6ztnwcSRDC
PiMEYsUXVX2+zDKPUf9eainX7RalyxED6UOv87t7sPvGzUvTV5N0KiRykSnQqarO
jBb3MqkhRo0wOWdSsXqQXi4fjXuh1etofXIXbfTf6GmRk3L+B85o8NZnxRrIU3Oo
n4wi9E03VVmIfoFwePqcAc8XDk7jZHywJD9JG85nph06JYlZ8xBwOLKcwIvATP1E
3cL4bnKU9gqWpZH08L+dHW+546zXgVzVBEkhFZFLJ5DbvJn3BaVEsNuqY6/Nw6k9
OZnI6P8jA2X6Ot1nQtSWg6yEzFUuSbeCxyJmYDjaUVoFSj12qFK1dzpEiYm9p6Tp
Iycbfzf4q/gZzC/fCqmOPqPiDzPFGtLjOwemDTylgVtKDATGlG4NqyH2ZXnhSyo0
hb+gtigO1CrdlGaYoMNY6OycCx5zOdLK6dqihvJMBzfDG4jeVxEyNplFJSaxsNPR
cF42IS0CsQ+m9CQKLUFMtLEFjWP7SgoNXy+fQr0hVW2AQembNUw=
=G2tk
-----END PGP SIGNATURE-----
pgpSc02NrHN2o.pgp
Description: PGP signature
--- End Message ---
