{"id":"CVE-2026-114613","summary":"MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure","details":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.","aliases":["GHSA-j586-36cw-2gc2"],"modified":"2026-10-23T13:06:34.338612181Z","published":"2026-10-22T18:22:40.544Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114613.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-401"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114613.json"},{"type":"FIX","url":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141"},{"type":"WEB","url":"https://github.com/msgpack/msgpack-python/releases/tag/v1.2.3"},{"type":"ADVISORY","url":"https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114613"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/msgpack/msgpack-python","events":[{"introduced":"0"},{"fixed":"742cb6d7ad141343edcccc829b5b06d0c6f8fcb5"},{"fixed":"620b0eb4c89cd72d4098564537624d9dbb2ce141"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"1.2.3"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"620b0eb4c89cd72d4098564537624d9dbb2ce141"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"742cb6d7ad141343edcccc829b5b06d0c6f8fcb5"}],"source":"REFERENCES_TAG","original_tag":"v1.2.3"}]}}],"versions":["v1.2.2","v1.2.1","v1.2.0","v1.2.0rc1","v1.1.2","v1.1.1","v1.1.1rc1","v1.1.0","v1.1.0rc2","v1.1.0rc1","v1.0.8","v1.0.7","v1.0.6","v1.0.6rc1","v1.0.5","v1.0.5rc1","v1.0.4","v1.0.4rc1","v1.0.3","v1.0.3rc1","v1.0.2","v1.0.1","v1.0.0","v1.0.0rc1","v0.6.2","v0.6.1","v0.6.0","0.5.6","0.5.5","0.5.4","0.5.2","0.5.1","0.5.0","0.4.7","0.4.6","0.4.4","0.4.3","0.4.2","0.4.1","0.4.0","0.3.0","0.2.2","0.2.1","0.2.0","0.1.13","0.1.12","0.1.11","0.1.10"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114613.json","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_template.h","function":"unpack_data"},"deprecated":false,"digest":{"function_hash":"24819002671862410050487909406970712128","length":92},"id":"CVE-2026-114613-0b959d9f","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"256120399832704237003046394108400235680","length":6907},"id":"CVE-2026-114613-1158c134","signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"function":"unpack_execute","file":"msgpack/unpack_template.h"}},{"id":"CVE-2026-114613-1fd759b3","signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_template.h","function":"unpack_init"},"deprecated":false,"digest":{"function_hash":"185224683605260886029505578369976209957","length":152}},{"signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_container_header.h","function":"unpack_container_header"},"deprecated":false,"digest":{"length":1216,"function_hash":"303760187552634058438686732918254437338"},"id":"CVE-2026-114613-38b45292","signature_type":"Function"},{"digest":{"length":237,"function_hash":"204606991681883861574830350882165759862"},"id":"CVE-2026-114613-4ffaa77f","signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack.h","function":"unpack_callback_array_end"},"deprecated":false},{"source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_template.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["292694976684289782463533948663790913592","162307428797838542523901319614034113195","113407413269607118321746262084900829729","286409352642613057305640786183412552723","118743805674301844560720586833293251151","90020706777981879446744372516653759576","323712261212301199155313200393309613005","164178004586463773083258642558370497349","232694962243417042621694984175425295338","277753315910937414540295406112819953103","228827297932887180556037751956226189441","276025297906173816315486907059103190714","311846825320403705486794995125297941997","88615093303852507855381194358759873046","119337668802747402296710447733479161941","320133445367471662810665234904988181269","67554871939857524885341203395262557559","173127728050218490376766497720728645251","109460067005182961000542171071314872803","57805302464387338829151641664473390380","106135276680429021859374647278862274226","269511466762205021449577184157338595163","314212714476140613467720525878013276635","145111753124499799682654255261214143549","122798394419666612918298257766151221415","155885434227387563780182594435592325993","97330817183186579233901908680922189078","271919312106431598091624843409922240590","149785984558259212605325617931517407866","230355078793088977960544260011626995826","93766134719898962717705291079438757259","34039542038414886134892232387094602386","24982217836997780121947327768336533665","271725863194165161855494455419864779067","30595397200354094191267268538080783285","273626359231347947925195206133130817529","326152504808191390435420168983020062600","152015248774748838671735506242456353883","281615768474726205826384694325202098361","107116948408278436365389074692462849561","174186291548261555857136588478039641574","51920071624447094418944834683633297899","86502813740672248113338705248765342403","195088348616812733440328495075262397808","236172907073619594749606317205403966751","192818893592265672644140488730376690147","24807634286848399925658690376146652620","4969821661838960772348698755232692995","61008449451235668654303673374786459654","223132875596517470318558006160954914006","233826598483206410552066124664001292464","163986748590278480602327103968520236161","73069041693790584782212830179373985123","75779615222496255634732149417769414283","245568237345989912120997899201264392193","169240620229246754542670937758110568610","158564371210901886925828864834710909281","168961201194728712134785819072337523543","270115298847980999613800288345033459409","6039454810344792891478925715281725232","15474786172052764560447452582603686415","124578409569870610394687527507957586950","198602401198708270624552063592910023479","330210466887623293382778253630080437878","25736334123804901474262494641656008961","123632626285149410458979583442780905526","95900151210194387252011782183324257207","224556153122587300299684001126369251217","135830729081029107871669353989931675693","158903951103183204137901844586790295658","2666799330243179229465498287716551404","167927087485333326148924093836484433504","93280006768755043535055822896982997790","160159980054819010708381296324783919829","163645344225137882884894388104013839004","113973031903964287996379214488689553829","297997817370461425210022413400040028256","289803602764451047801364551717536679513","280081132238377997811830273696007056983","317248064897655038370734051883495174106","289279638503929880984071445684688849707","173424823920712899279193151232235247099","86068477114757072739477521809921433422","185388925693504490279195891875450946421","167354469615958146346925805850797017124","292409527995835303632923869359525537281","314250719980980463016652381084551508731","71049587194947140112322105368930290775","54996300299068167249823275785796704642","234561404186299712163489968879513227844","335659456520674577918004890208353217171","204469332593521438269180603812187719106","262127264131298023456319112880673107315","222898939529528600302178916875206650071","148865455270858654899563412792480989706","187763855881755892751812432892175592169","99161169222797108242434143929898496618","188447289773578519333883053155798226835","200602235533918366840648257986621458589","323870745625214019652045276434926675037","275363001793923498039202611321289336815","208314181844705960834279224558451601016","187763855881755892751812432892175592169","99161169222797108242434143929898496618","286446561186129550262364182546911474234","235556813055606750125486414671006250967"]},"id":"CVE-2026-114613-59afe8c6","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack.h","function":"unpack_callback_map_item"},"deprecated":false,"digest":{"length":713,"function_hash":"79745523442496762200055255876423677097"},"id":"CVE-2026-114613-7bdd0b38"},{"deprecated":false,"digest":{"function_hash":"170550609489875113951668446662430965125","length":283},"id":"CVE-2026-114613-ad1e2f0b","signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_template.h","function":"unpack_clear"}},{"id":"CVE-2026-114613-c78dfeb1","signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_template.h","function":"unpack_construct"},"deprecated":false,"digest":{"function_hash":"106545750831006085603400067027250505556","length":212}},{"target":{"file":"msgpack/unpack.h","function":"unpack_callback_map_end"},"deprecated":false,"digest":{"function_hash":"77976570937944357067926810551949162701","length":241},"id":"CVE-2026-114613-caa895c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141"},{"deprecated":false,"digest":{"line_hashes":["22303600065773242496436906613010141216","262814046664783485828590723324459918648","135064704462971479663553560896164098633","151678702317781210352484728755839407633","187780500381840814601867268995490664373","58941205471858379543621615810546534175","115269048208644307977279095680902407258","217418267165852507743294057192122438102","289094806302396235889477258695695818235","235279182900419434322983808253946221255","136109663151112544467166990659531959428","89741620467241226415294547709815625950","97459140172163381671823622365647473901","222595464813934588161590272374069346183","101310651880550736491634133680752052275","737610368618627747835955120478563111","206360546756991089394920866030432886392","38817089329899560745266500575535564899","74770926291658010285106529190274222978","60180815569751896861125934491091313672","293519925559726837281793070768135715600","154158471396170467168168376824254879340","226752485877396431049211916754586542567","193128094948004369743905325229799121638","242261867526921682612524323059569249006","36666801341023570584349751719680642594","233430404155779750710621597135283581634","90231066457114095540311130762645727771","145032558701070040837504596564472147696","291951007246698798374991055519318525354","103340786320953796437655173336692406229","262200430628604121672626413876972384075","296121833145557636356531413714635248203","82687012046995890709888827121377737263","62114498817760496619521698286617735765","53217765265362319676987308101745565030","83535251460758979623759619812328848915","84775636895690568387717873917545466754","150579770202070747023050317984535736791","196193450248261884855456534929953401467","97532115002833410843401562063018218202","102643537659847736229356036207161187597","79389138932302112493142762702930945198","244269248465803288962447195621286756039","320940186725428520437744079123668658279","288743190852971808466563628043444283065","49874413826660930965252414935771252516","25479642640079300950932169702696344784","197127971820048259166951269318070182048","38817089329899560745266500575535564899","74770926291658010285106529190274222978","60180815569751896861125934491091313672","293519925559726837281793070768135715600"],"threshold":0.9},"id":"CVE-2026-114613-db4c35e5","signature_type":"Line","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack.h"}},{"digest":{"function_hash":"115996986103489458053618121225935122781","length":212},"id":"CVE-2026-114613-fb693c37","signature_type":"Function","signature_version":"v1","source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_template.h","function":"unpack_skip"},"deprecated":false},{"source":"https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141","target":{"file":"msgpack/unpack_container_header.h"},"deprecated":false,"digest":{"line_hashes":["75724636992249371398100189477287996006","172837428011666423664696602531988559015","373158234132289602264400027403467695","76991138526711078485060704542532933030"],"threshold":0.9},"id":"CVE-2026-114613-fea271dc","signature_type":"Line","signature_version":"v1"}],"vanir_signatures_modified":"2026-10-23T13:06:34Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}