Msgpack vulnerabilities
We track 4 vulnerabilities in Msgpack products across 4 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Msgpack vulnerabilities
- 7.5 High severity
msgpack-ruby: Allocation of Resources Without Limits or Throttling
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes befor
- 7.5 High severity
msgpack-python: Missing Release of Memory after Effective Lifetime
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inpu
- 7.5 High severity
msgpack-python: Use After Free
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the
- 7.5 High severity
msgpack-java: Uncontrolled Resource Consumption
MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parse