CVE-2026-57585

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d	Patch
https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:python:*:*

History

25 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) MessagePack es la implementación del serializador para Python msgpack.org. Antes de la versión 1.2.1, existe una lectura fuera de límites/un fallo al reutilizar el Unpacker después de un error capturado, lo que podría conducir a un ataque DoS. Si el Unpacker se utiliza repetidamente después de que ocurra un error, el proceso podría fallar con un SEGV. Este problema ha sido solucionado en la versión 1.2.1.

Information

Published : 2026-06-30 22:16

Updated : 2026-10-25 21:10

NVD link : CVE-2026-57585

Mitre link : CVE-2026-57585

CVE.ORG link : CVE-2026-57585

JSON object : View

Products Affected

msgpack

messagepack

CWE

CWE-416

Use After Free

{"id": "CVE-2026-57585", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-57585", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-01T14:54:21.105642Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "msgpack", "product": "msgpack-python", "versions": [{"status": "affected", "version": "< 1.2.1"}]}]}], "published": "2026-06-30T22:16:57.837", "references": [{"url": "https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1."}, {"lang": "es", "value": "MessagePack es la implementaci\u00f3n del serializador para Python msgpack.org. Antes de la versi\u00f3n 1.2.1, existe una lectura fuera de l\u00edmites/un fallo al reutilizar el Unpacker despu\u00e9s de un error capturado, lo que podr\u00eda conducir a un ataque DoS. Si el Unpacker se utiliza repetidamente despu\u00e9s de que ocurra un error, el proceso podr\u00eda fallar con un SEGV. Este problema ha sido solucionado en la versi\u00f3n 1.2.1."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "A097F45C-8DB1-45AD-88DB-EA7AA3F7F994", "versionEndExcluding": "1.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}