CVE-2026-32284CWE-125

CVE-2026-32284

High · published March 27, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
52.4
In the wild
Unconfirmed
What it is

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00695 · 52.4th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-03-27T00:16Z
Affected products (1)
ProductVersionsFixed in
shamaton/msgpack≤ 3.1.2—
References (4)
https://github.com/golang/vulndb/issues/4513 · [email protected]https://github.com/shamaton/msgpack/issues/59 · [email protected]https://pkg.go.dev/vuln/GO-2026-4513 · [email protected]https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 26 MAR 19:40Z
    Denial of service in github.com/shamaton/msgpack
    cvelistv5