msgpack
PyPI2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting msgpackpage 1 of 1
- CVE-2026-114613HIGHCVSS 7.5EG 7.5fixed in 1.2.32026-10-22
vulnerable: 0.5.0 ... 1.2.2 (34 versions)
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Re…
- CVE-2026-57585HIGHCVSS 7.5EG 7.5fixed in 1.2.12026-06-30
vulnerable: 0.5.0 ... 1.2.0rc1 (32 versions)
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly afte…
Check whether msgpack is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for msgpack CVEs against the assets you own.
Book a Demo →