CVE-2026-114613

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114613
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114613.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114613
Aliases
Downstream
AZL (1)
CGA (364)
CLEANSTART (4)
DEBIAN (1)
ECHO (1)
MINI (3)
ROOT (1)
Published
2026-10-22T18:22:40Z
Modified
2026-10-28T10:51:21Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
Details

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-401"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114613.json"
}
References

Affected packages

Git / github.com/msgpack/msgpack-python

Affected ranges

Type
GIT
Repo
https://github.com/msgpack/msgpack-python
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
742cb6d7ad141343edcccc829b5b06d0c6f8fcb5
Fixed
620b0eb4c89cd72d4098564537624d9dbb2ce141
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.2.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "620b0eb4c89cd72d4098564537624d9dbb2ce141"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "v1.2.3",
            "range": [
                {
                    "fixed": "742cb6d7ad141343edcccc829b5b06d0c6f8fcb5"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*
0.1.10
0.1.11
0.1.12
0.1.13
0.2.0
0.2.1
0.2.2
0.3.0
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.4.6
0.4.7
0.5.0
0.5.1
0.5.2
0.5.4
0.5.5
0.5.6
v0.*
v0.6.0
v0.6.1
v0.6.2
v1.*
v1.0.0
v1.0.0rc1
v1.0.1
v1.0.2
v1.0.3
v1.0.3rc1
v1.0.4
v1.0.4rc1
v1.0.5
v1.0.5rc1
v1.0.6
v1.0.6rc1
v1.0.7
v1.0.8
v1.1.0
v1.1.0rc1
v1.1.0rc2
v1.1.1
v1.1.1rc1
v1.1.2
v1.2.0
v1.2.0rc1
v1.2.1
v1.2.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114613.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "24819002671862410050487909406970712128",
            "length": 92
        },
        "id": "CVE-2026-114613-0b959d9f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_template.h",
            "function": "unpack_data"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "256120399832704237003046394108400235680",
            "length": 6907
        },
        "id": "CVE-2026-114613-1158c134",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_template.h",
            "function": "unpack_execute"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "185224683605260886029505578369976209957",
            "length": 152
        },
        "id": "CVE-2026-114613-1fd759b3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_template.h",
            "function": "unpack_init"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "303760187552634058438686732918254437338",
            "length": 1216
        },
        "id": "CVE-2026-114613-38b45292",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_container_header.h",
            "function": "unpack_container_header"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "204606991681883861574830350882165759862",
            "length": 237
        },
        "id": "CVE-2026-114613-4ffaa77f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack.h",
            "function": "unpack_callback_array_end"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "292694976684289782463533948663790913592",
                "162307428797838542523901319614034113195",
                "113407413269607118321746262084900829729",
                "286409352642613057305640786183412552723",
                "118743805674301844560720586833293251151",
                "90020706777981879446744372516653759576",
                "323712261212301199155313200393309613005",
                "164178004586463773083258642558370497349",
                "232694962243417042621694984175425295338",
                "277753315910937414540295406112819953103",
                "228827297932887180556037751956226189441",
                "276025297906173816315486907059103190714",
                "311846825320403705486794995125297941997",
                "88615093303852507855381194358759873046",
                "119337668802747402296710447733479161941",
                "320133445367471662810665234904988181269",
                "67554871939857524885341203395262557559",
                "173127728050218490376766497720728645251",
                "109460067005182961000542171071314872803",
                "57805302464387338829151641664473390380",
                "106135276680429021859374647278862274226",
                "269511466762205021449577184157338595163",
                "314212714476140613467720525878013276635",
                "145111753124499799682654255261214143549",
                "122798394419666612918298257766151221415",
                "155885434227387563780182594435592325993",
                "97330817183186579233901908680922189078",
                "271919312106431598091624843409922240590",
                "149785984558259212605325617931517407866",
                "230355078793088977960544260011626995826",
                "93766134719898962717705291079438757259",
                "34039542038414886134892232387094602386",
                "24982217836997780121947327768336533665",
                "271725863194165161855494455419864779067",
                "30595397200354094191267268538080783285",
                "273626359231347947925195206133130817529",
                "326152504808191390435420168983020062600",
                "152015248774748838671735506242456353883",
                "281615768474726205826384694325202098361",
                "107116948408278436365389074692462849561",
                "174186291548261555857136588478039641574",
                "51920071624447094418944834683633297899",
                "86502813740672248113338705248765342403",
                "195088348616812733440328495075262397808",
                "236172907073619594749606317205403966751",
                "192818893592265672644140488730376690147",
                "24807634286848399925658690376146652620",
                "4969821661838960772348698755232692995",
                "61008449451235668654303673374786459654",
                "223132875596517470318558006160954914006",
                "233826598483206410552066124664001292464",
                "163986748590278480602327103968520236161",
                "73069041693790584782212830179373985123",
                "75779615222496255634732149417769414283",
                "245568237345989912120997899201264392193",
                "169240620229246754542670937758110568610",
                "158564371210901886925828864834710909281",
                "168961201194728712134785819072337523543",
                "270115298847980999613800288345033459409",
                "6039454810344792891478925715281725232",
                "15474786172052764560447452582603686415",
                "124578409569870610394687527507957586950",
                "198602401198708270624552063592910023479",
                "330210466887623293382778253630080437878",
                "25736334123804901474262494641656008961",
                "123632626285149410458979583442780905526",
                "95900151210194387252011782183324257207",
                "224556153122587300299684001126369251217",
                "135830729081029107871669353989931675693",
                "158903951103183204137901844586790295658",
                "2666799330243179229465498287716551404",
                "167927087485333326148924093836484433504",
                "93280006768755043535055822896982997790",
                "160159980054819010708381296324783919829",
                "163645344225137882884894388104013839004",
                "113973031903964287996379214488689553829",
                "297997817370461425210022413400040028256",
                "289803602764451047801364551717536679513",
                "280081132238377997811830273696007056983",
                "317248064897655038370734051883495174106",
                "289279638503929880984071445684688849707",
                "173424823920712899279193151232235247099",
                "86068477114757072739477521809921433422",
                "185388925693504490279195891875450946421",
                "167354469615958146346925805850797017124",
                "292409527995835303632923869359525537281",
                "314250719980980463016652381084551508731",
                "71049587194947140112322105368930290775",
                "54996300299068167249823275785796704642",
                "234561404186299712163489968879513227844",
                "335659456520674577918004890208353217171",
                "204469332593521438269180603812187719106",
                "262127264131298023456319112880673107315",
                "222898939529528600302178916875206650071",
                "148865455270858654899563412792480989706",
                "187763855881755892751812432892175592169",
                "99161169222797108242434143929898496618",
                "188447289773578519333883053155798226835",
                "200602235533918366840648257986621458589",
                "323870745625214019652045276434926675037",
                "275363001793923498039202611321289336815",
                "208314181844705960834279224558451601016",
                "187763855881755892751812432892175592169",
                "99161169222797108242434143929898496618",
                "286446561186129550262364182546911474234",
                "235556813055606750125486414671006250967"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-114613-59afe8c6",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_template.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "79745523442496762200055255876423677097",
            "length": 713
        },
        "id": "CVE-2026-114613-7bdd0b38",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack.h",
            "function": "unpack_callback_map_item"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "170550609489875113951668446662430965125",
            "length": 283
        },
        "id": "CVE-2026-114613-ad1e2f0b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_template.h",
            "function": "unpack_clear"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "106545750831006085603400067027250505556",
            "length": 212
        },
        "id": "CVE-2026-114613-c78dfeb1",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_template.h",
            "function": "unpack_construct"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "77976570937944357067926810551949162701",
            "length": 241
        },
        "id": "CVE-2026-114613-caa895c9",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack.h",
            "function": "unpack_callback_map_end"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "22303600065773242496436906613010141216",
                "262814046664783485828590723324459918648",
                "135064704462971479663553560896164098633",
                "151678702317781210352484728755839407633",
                "187780500381840814601867268995490664373",
                "58941205471858379543621615810546534175",
                "115269048208644307977279095680902407258",
                "217418267165852507743294057192122438102",
                "289094806302396235889477258695695818235",
                "235279182900419434322983808253946221255",
                "136109663151112544467166990659531959428",
                "89741620467241226415294547709815625950",
                "97459140172163381671823622365647473901",
                "222595464813934588161590272374069346183",
                "101310651880550736491634133680752052275",
                "737610368618627747835955120478563111",
                "206360546756991089394920866030432886392",
                "38817089329899560745266500575535564899",
                "74770926291658010285106529190274222978",
                "60180815569751896861125934491091313672",
                "293519925559726837281793070768135715600",
                "154158471396170467168168376824254879340",
                "226752485877396431049211916754586542567",
                "193128094948004369743905325229799121638",
                "242261867526921682612524323059569249006",
                "36666801341023570584349751719680642594",
                "233430404155779750710621597135283581634",
                "90231066457114095540311130762645727771",
                "145032558701070040837504596564472147696",
                "291951007246698798374991055519318525354",
                "103340786320953796437655173336692406229",
                "262200430628604121672626413876972384075",
                "296121833145557636356531413714635248203",
                "82687012046995890709888827121377737263",
                "62114498817760496619521698286617735765",
                "53217765265362319676987308101745565030",
                "83535251460758979623759619812328848915",
                "84775636895690568387717873917545466754",
                "150579770202070747023050317984535736791",
                "196193450248261884855456534929953401467",
                "97532115002833410843401562063018218202",
                "102643537659847736229356036207161187597",
                "79389138932302112493142762702930945198",
                "244269248465803288962447195621286756039",
                "320940186725428520437744079123668658279",
                "288743190852971808466563628043444283065",
                "49874413826660930965252414935771252516",
                "25479642640079300950932169702696344784",
                "197127971820048259166951269318070182048",
                "38817089329899560745266500575535564899",
                "74770926291658010285106529190274222978",
                "60180815569751896861125934491091313672",
                "293519925559726837281793070768135715600"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-114613-db4c35e5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack.h"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "115996986103489458053618121225935122781",
            "length": 212
        },
        "id": "CVE-2026-114613-fb693c37",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_template.h",
            "function": "unpack_skip"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "75724636992249371398100189477287996006",
                "172837428011666423664696602531988559015",
                "373158234132289602264400027403467695",
                "76991138526711078485060704542532933030"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-114613-fea271dc",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141",
        "target": {
            "file": "msgpack/unpack_container_header.h"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T10:51:21Z"