Vulnerability in Msgpack Msgpack-Python
CVE-2026-114613
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
Published .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Msgpack Msgpack-Python — versions < 1.2.3
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-114613?
- CVE-2026-114613 is a high-severity vulnerability in Msgpack Msgpack-Python, classified under Missing Release of Memory after Effective Lifetime. CVSS score: 7.5/10. Published 2026-10-22.
- How severe is CVE-2026-114613?
- High severity. CVSS v3 base score is 7.5 out of 10.