{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amsgpackmsgpackpython/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:msgpack:msgpack:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-114613"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["msgpack-python (\u003c 1.2.3)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe msgpack-python C extension (\u003ccode\u003emsgpack._cmsgpack\u003c/code\u003e) is vulnerable to an unbounded memory leak when deserializing MessagePack data that fails \u003ccode\u003estrict_map_key\u003c/code\u003e validation. The vulnerability occurs because the C extension fails to release references to constructed map values when a key is rejected. This can be exploited to cause a denial of service via memory exhaustion.\u003c/p\u003e\n\u003cp\u003eAdditionally, an audit identified a use-after-free condition in the streaming \u003ccode\u003eUnpacker\u003c/code\u003e API. Stale references to objects in the parser stack can lead to incorrect reference count decrements (double \u003ccode\u003ePy_DECREF\u003c/code\u003e) if parsing fails after a nested container is processed. This can result in application crashes or memory corruption. Both vulnerabilities are tracked under CVE-2026-114613.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eMemory Leak:\u003c/strong\u003e Observed retention of approximately 4 MiB of memory per failed parse, leading to rapid process memory growth and potential service instability.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMemory Safety:\u003c/strong\u003e The reference count corruption in the streaming API may lead to unpredictable application behavior, crashes, or use-after-free vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u003ccode\u003emsgpack\u003c/code\u003e to version 1.2.3 or later immediately to address the memory leak and reference count corruption.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, evaluate the use of the pure-Python implementation of \u003ccode\u003emsgpack\u003c/code\u003e, which is reported not to exhibit this specific leak, though it may have performance implications.\u003c/li\u003e\n\u003cli\u003eImplement strict request-size and request-rate limiting at the application or WAF level for endpoints that accept MessagePack data to mitigate the impact of malicious inputs on memory utilization.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T17:57:55Z","date_published":"2026-10-27T17:57:55Z","id":"https://feed.craftedsignal.io/briefs/2026-10-msgpack-memory-leak/","summary":"The msgpack-python C extension contains a memory leak and a reference count corruption vulnerability triggered during deserialization of malformed data, enabling denial of service and potential memory safety issues.","title":"msgpack-python: Memory leak and use-after-free vulnerability (CVE-2026-114613)","url":"https://feed.craftedsignal.io/briefs/2026-10-msgpack-memory-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:msgpack:msgpack:*:*:*:*:*:python:*:*","version":"https://jsonfeed.org/version/1.1"}