CVE-2026-114613 — MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

Affected: msgpack-python

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

GHSA-j586-36cw-2gc2 — MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

Affected: PyPI: msgpack

### Impact

The msgpack-python C extension (`msgpack._cmsgpack`) leaks a decoded map value when deserialization rejects a key with `strict_map_key=True` (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both `unpackb()` and the streaming `Unpacker` API are affected. The pure-Python fallback does not exhibit this leak in the reported tests.

The report measured approximately 4 MiB retained per failed parse and 100 MiB after 25 failed parses on Windows with Python 3.14 and msgpack 1.2.2. These are reporter-provided results.

### Additional impact: stale parser-stack references

The reference-ownership audit performed while fixing this leak found an additional memory-safety issue in the streaming `Unpacker`.

After `unpack()` completed a nested container, an inactive parser-stack slot could retain a non-owning pointer to the decoded object. A subsequent `skip()` could reactivate that slot. If parsing then failed, context cleanup treated the stale pointer as an owned reference and decremented it.

This corrupts the object's reference count and can result in a use-after-free or double `Py_DECREF` when its actual owners later release it.

Although few users use this API, but those who do may experience crashes or unexpected errors due to a use-after-free.

### Details

In `msgpack/unpack.h`, `unpack_callback_map_item()` rejects keys that are neither `str` n…

Most recent entries from all

CVE-2026-114613 — MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

GHSA-j586-36cw-2gc2 — MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure