PYSEC-2026-3625

See a problem?

Import Source

https://github.com/pypa/advisory-database/blob/main/vulns/msgpack/PYSEC-2026-3625.yaml

JSON Data

https://api.osv.dev/v1/vulns/PYSEC-2026-3625

Aliases

Published

2026-06-30T22:16:57.837Z

Modified

2026-08-07T09:45:09.966898625Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

References

Affected packages

PyPI / msgpack

Package

Name: msgpack; View open source insights on deps.dev
Purl: pkg:pypi/msgpack

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.1

Affected versions

0.*

0.5.0

0.5.1

0.5.2

0.5.3

0.5.4

0.5.5

0.5.6

0.6.0

0.6.1

0.6.2

1.*

1.0.0rc1

1.0.0

1.0.1

1.0.2

1.0.3rc1

1.0.3

1.0.4rc1

1.0.4

1.0.5rc1

1.0.5

1.0.6rc1

1.0.6

1.0.7

1.0.8

1.1.0rc1

1.1.0rc2

1.1.0

1.1.1rc1

1.1.1

1.1.2

1.2.0rc1

1.2.0

Database specific

source

"https://github.com/pypa/advisory-database/blob/main/vulns/msgpack/PYSEC-2026-3625.yaml"