CVE-2026-114613: MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack.cmsgpack) leaks a decoded map value when deserialization rejects a key with strictmapkey=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
msgpack-pythonto a version that resolves this vulnerability.Fixed in 1.2.3
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Applications using msgpack-python versions before 1.2.3 with the msgpack._cmsgpack C extension are affected when they deserialize attacker-controlled MessagePack input. The pure-Python fallback did not exhibit the leak in the reported tests.
Does an application need to enable a non-default option to be affected?
No. The leak is triggered when strict_map_key=True rejects a decoded map key, and strict_map_key=True is the default.
Which MessagePack interfaces can trigger the leak?
Both unpackb() and the streaming Unpacker API are affected. Repeated malformed inputs can cause unbounded process memory growth.
What can be done if upgrading immediately is not possible?
Avoid deserializing attacker-controlled MessagePack data with the affected C extension, or use the pure-Python fallback, which did not exhibit this leak in the reported tests. Upgrade to msgpack-python 1.2.3 when possible.