AZL-111044: CVE-2026-114613 affecting package python-msgpack 1.0.5-3

Q: Which applications are realistically exposed to denial of service?

Applications using the msgpack._cmsgpack C extension to deserialize attacker-controlled MessagePack data are exposed. Both unpackb() and the streaming Unpacker API are affected; the pure-Python fallback did not exhibit the leak in reported tests.

Q: Does exploitation require a non-default setting?

No. The leak occurs when strict_map_key=True rejects a decoded map key, and strict_map_key=True is the default setting. An attacker needs to repeatedly provide malformed MessagePack inputs that trigger this rejection.

Q: How can I reduce risk before updating?

Avoid deserializing untrusted MessagePack data with the affected C extension where possible. Using the pure-Python fallback avoids the leak in the reported tests, and limiting or rejecting untrusted MessagePack input can reduce exposure.

Q: What version contains the fix?

The issue is fixed in msgpack version 1.2.3. The affected package identified here is python-msgpack 1.0.5-3.

Published Oct 22, 2026

Updated

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack.cmsgpack) leaks a decoded map value when deserialization rejects a key with strictmapkey=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

Affected Software

1 affected component

azure-linux/python-msgpack<=1.0.5-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade python-msgpack to a version that resolves this vulnerability.
Fixed in 1.2.3

Event History

Oct 22, 2026

Advisory Published

via OSV·07:17 PM

Data Sourced

via OSV·07:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114613

Frequently Asked Questions

Which applications are realistically exposed to denial of service?

Applications using the msgpack._cmsgpack C extension to deserialize attacker-controlled MessagePack data are exposed. Both unpackb() and the streaming Unpacker API are affected; the pure-Python fallback did not exhibit the leak in reported tests.

Does exploitation require a non-default setting?

No. The leak occurs when strict_map_key=True rejects a decoded map key, and strict_map_key=True is the default setting. An attacker needs to repeatedly provide malformed MessagePack inputs that trigger this rejection.

How can I reduce risk before updating?

Avoid deserializing untrusted MessagePack data with the affected C extension where possible. Using the pure-Python fallback avoids the leak in the reported tests, and limiting or rejecting untrusted MessagePack input can reduce exposure.

What version contains the fix?

The issue is fixed in msgpack version 1.2.3. The affected package identified here is python-msgpack 1.0.5-3.

AZL-111044: CVE-2026-114613 affecting package python-msgpack 1.0.5-3

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which applications are realistically exposed to denial of service?

Does exploitation require a non-default setting?

How can I reduce risk before updating?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to denial of service?

Does exploitation require a non-default setting?

How can I reduce risk before updating?

What version contains the fix?