msgpack-python vulnerabilities

2 known vulnerabilities in msgpack-python from Msgpack. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  msgpack-python: Missing Release of Memory after Effective Lifetime

  CVE-2026-114613Oct 22, 2026Msgpack

  MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inpu

• 7.5 High severity

  msgpack-python: Use After Free

  CVE-2026-57585Jun 30, 2026Msgpack

  MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the