CVE-2026-57585: MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
Other sources
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.0.5-3 - Upgrade
Upgrade
MessagePack (Python msgpack.org)to a version that resolves this vulnerability.Fixed in 1.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57585?
The severity of CVE-2026-57585 is high, rated at 7.5.
How does CVE-2026-57585 exploit occur?
CVE-2026-57585 can exploit through an Out-of-bounds read/crash when the Unpacker is reused after an error.
How can I mitigate CVE-2026-57585?
To mitigate CVE-2026-57585, update to MessagePack version 1.2.1 or later.
What impact does CVE-2026-57585 have on systems?
CVE-2026-57585 can lead to a denial-of-service (DoS) attack by crashing the process.
Which software is affected by CVE-2026-57585?
CVE-2026-57585 affects the MessagePack library in msgpack-python prior to version 1.2.1.