Cpe:2.3:a:msgpack:msgpack:*:*:*:*:*:python:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amsgpackmsgpackpython/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 17:57:55 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgmsgpack-python: Memory leak and use-after-free vulnerability (CVE-2026-114613)https://feed.craftedsignal.io/briefs/2026-10-msgpack-memory-leak/Tue, 27 Oct 2026 17:57:55 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-msgpack-memory-leak/The msgpack-python C extension contains a memory leak and a reference count corruption vulnerability triggered during deserialization of malformed data, enabling denial of service and potential memory safety issues.The msgpack-python C extension (msgpack._cmsgpack) is vulnerable to an unbounded memory leak when deserializing MessagePack data that fails strict_map_key validation. The vulnerability occurs because the C extension fails to release references to constructed map values when a key is rejected. This can be exploited to cause a denial of service via memory exhaustion.

Additionally, an audit identified a use-after-free condition in the streaming Unpacker API. Stale references to objects in the parser stack can lead to incorrect reference count decrements (double Py_DECREF) if parsing fails after a nested container is processed. This can result in application crashes or memory corruption. Both vulnerabilities are tracked under CVE-2026-114613.

Impact

  • Memory Leak: Observed retention of approximately 4 MiB of memory per failed parse, leading to rapid process memory growth and potential service instability.
  • Memory Safety: The reference count corruption in the streaming API may lead to unpredictable application behavior, crashes, or use-after-free vulnerabilities.

Recommendation

  • Upgrade msgpack to version 1.2.3 or later immediately to address the memory leak and reference count corruption.
  • If immediate patching is not possible, evaluate the use of the pure-Python implementation of msgpack, which is reported not to exhibit this specific leak, though it may have performance implications.
  • Implement strict request-size and request-rate limiting at the application or WAF level for endpoints that accept MessagePack data to mitigate the impact of malicious inputs on memory utilization.
]]>lowadvisory