msgpack-python: Memory leak and use-after-free vulnerability (CVE-2026-114613)

The msgpack-python C extension (msgpack._cmsgpack) is vulnerable to an unbounded memory leak when deserializing MessagePack data that fails strict_map_key validation. The vulnerability occurs because the C extension fails to release references to constructed map values when a key is rejected. This can be exploited to cause a denial of service via memory exhaustion.

Additionally, an audit identified a use-after-free condition in the streaming Unpacker API. Stale references to objects in the parser stack can lead to incorrect reference count decrements (double Py_DECREF) if parsing fails after a nested container is processed. This can result in application crashes or memory corruption. Both vulnerabilities are tracked under CVE-2026-114613.

Impact

• Memory Leak: Observed retention of approximately 4 MiB of memory per failed parse, leading to rapid process memory growth and potential service instability.
• Memory Safety: The reference count corruption in the streaming API may lead to unpredictable application behavior, crashes, or use-after-free vulnerabilities.

Recommendation

• Upgrade msgpack to version 1.2.3 or later immediately to address the memory leak and reference count corruption.
• If immediate patching is not possible, evaluate the use of the pure-Python implementation of msgpack, which is reported not to exhibit this specific leak, though it may have performance implications.
• Implement strict request-size and request-rate limiting at the application or WAF level for endpoints that accept MessagePack data to mitigate the impact of malicious inputs on memory utilization.