Messagepack vulnerabilities

2 known vulnerabilities in Messagepack from Msgpack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  msgpack-python: Use After Free

  CVE-2026-57585Jun 30, 2026Msgpack

  MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the

• 7.5 High severity

  msgpack-java: Uncontrolled Resource Consumption

  CVE-2026-21452Jan 2, 2026Msgpack

  MessagePack for Java is a serializer implementation for Java. A denial-of-service vulnerability exists in versions prior to 0.9.11 when deserializing .msgpack files containing EXT32 objects with attacker-controlled payload lengths. While MessagePack-Java parse