CVE-2026-114613— MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
Quick assessment
Affected
msgpack msgpack-python
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
MessagePack 是 Python 中用于 msgpack.org 的序列化实现。在 1.2.3 版本之前，msgpack-python 的 C 扩展模块（msgpack._cmsgpack）在反序列化过程中，若因 strict_map_key=True（默认设置）而拒绝某个键时，会泄露已解码的映射（map）值。攻击者可利用重复的畸形输入，导致处理攻击者控制 MessagePack 数据的应用程序出现无限制进程内存增长，进而引发拒绝服务（DoS）攻击。该问题同时影响 unpackb() 函数和流式 Unpac
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| msgpack | msgpack-python | < 1.2.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-114613
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
Source: CVE Program / CVE List V5
Vulnerability Description
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在移除最后引用时对内存的释放不恰当(内存泄露)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| msgpack | msgpack-python | < 1.2.3 | - |
|
II. Public POCs for CVE-2026-114613
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-114613
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-114613 (1)
-
🔗 Merge commit from fork · msgpack/msgpack-python@620b0eb · GitHub x_refsource_MISC
Vendor Advisories for CVE-2026-114613 (1)
IV. Related Vulnerabilities
Same vendor: msgpack
-
CVE-2026-90473
msgpack-java through 0.9.12 Integer Overflow via MAP32 -
CVE-2026-90472
msgpack-java through 0.9.12 Stack Overflow via Nested Arrays -
CVE-2026-72854
msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer -
CVE-2026-54522
MessagePack::Buffer#clear Use-After-Free that Enables Cross- -
CVE-2026-57585
MessagePack: Out-of-bounds read/crash on Unpacker reuse afte
Same weakness: CWE-401
-
CVE-2026-76489
Multiple Cisco Products Snort 3 Generic File Processing Memo -
CVE-2026-77684
Bluetooth Classic HFP Hands-Free: TX buffer leak on RFCOMM d -
CVE-2026-110685
Cpanel::JSON::XS versions before 4.80 for Perl leak the deco -
CVE-2026-110684
Cpanel::JSON::XS versions from 3.0202 before 4.80 for Perl l -
CVE-2026-110677
Cpanel::JSON::XS versions from 4.28 before 4.80 for Perl lea
V. Comments for CVE-2026-114613
No comments yet