Source: python-msgpack Version: 1.2.1-1 X-Debbugs-CC: [email protected] Severity: important Tags: security upstream
Hi, The following vulnerability was published for python-msgpack. CVE-2026-114613[0]: | MessagePack is the serializer implementation for Python msgpack.org. | Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) | leaks a decoded map value when deserialization rejects a key with | strict_map_key=True (the default). Repeated malformed inputs can | cause unbounded process memory growth and denial of service in | applications that deserialize attacker-controlled MessagePack data. | Both unpackb() and the streaming Unpacker API are affected. The | pure-Python fallback does not exhibit this leak in the reported | tests. This issue is fixed in version 1.2.3. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-114613 https://www.cve.org/CVERecord?id=CVE-2026-114613 [1] https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2 [2] https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
