CVE-2026-114613 with a CVSS score of 7.5 is a memory leak vulnerability affecting the msgpack Python library, specifically versions less than 1.2.3. The flaw resides in the C extension component, where the deserialization process fails to properly release memory references when strict map key validation rejects invalid keys. This issue impacts both the standard unpacking function and the streaming Unpacker API, while the pure-Python fallback implementation does not exhibit the same behavior. An attacker can exploit this vulnerability by sending repeated malformed MessagePack payloads to an application that processes untrusted data. Because the attack vector is network-based with low complexity and requires no prior authentication or user interaction, remote adversaries can trigger the condition easily. Each failed parse retains approximately four megabytes of memory, leading to unbounded process memory growth over time. Additionally, a related memory-safety issue in the streaming API can cause use-after-free conditions or reference count corruption, potentially resulting in application crashes. The primary business impact is a denial of service, as sustained exploitation causes the target process to exhaust available system memory, rendering the application unavailable. This poses a significant risk to services that rely on MessagePack for data exchange, as the cumulative leakage can degrade performance and eventually force service restarts or complete outages without any direct data compromise.
We recommend you to update msgpack to version 1.2.3.[/subscribe_to_unlock_form]
CVE-2026-114613 with a CVSS score of 7.5 is a memory leak vulnerability affecting the msgpack Python library, specifically versions less than 1.2.3. The flaw resides in the C extension component, where the deserialization process fails to properly release memory references when strict map key validation rejects invalid keys. This issue impacts both the standard unpacking function and the streaming Unpacker API, while the pure-Python fallback implementation does not exhibit the same behavior. An attacker can exploit this vulnerability by sending repeated malformed MessagePack payloads to an application that processes untrusted data. Because the attack vector is network-based with low complexity and requires no prior authentication or user interaction, remote adversaries can trigger the condition easily. Each failed parse retains approximately four megabytes of memory, leading to unbounded process memory growth over time. Additionally, a related memory-safety issue in the streaming API can cause use-after-free conditions or reference count corruption, potentially resulting in application crashes. The primary business impact is a denial of service, as sustained exploitation causes the target process to exhaust available system memory, rendering the application unavailable. This poses a significant risk to services that rely on MessagePack for data exchange, as the cumulative leakage can degrade performance and eventually force service restarts or complete outages without any direct data compromise.
We recommend you to update msgpack to version 1.2.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]