CVE-2026-57585CWE-416

CVE-2026-57585

High · published July 1, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
41.0
In the wild
Unconfirmed
What it is

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.0th percentile
Weakness
CWE-416 · Use After Free
Published
2026-07-01T02:16Z
Affected products (1)
ProductVersionsFixed in
msgpack/messagepack< 1.2.11.2.1
References (2)
https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d · [email protected]https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964 · [email protected]
EPSS history
Timeline
  • 30 JUN 21:36Z
    MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
    cvelistv5