CVE-2026-57585

Received Received - Intake

Out-of-bounds Read in Python msgpack Unpacker Reuse

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-57585

Affected Vendors & Products

Vendor	Product	Version / Range
msgpack	msgpack_python	to 1.2.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the MessagePack serializer implementation for Python (msgpack.org) versions prior to 1.2.1. It involves an out-of-bounds read or crash that occurs when the Unpacker object is reused after an error has been caught during unpacking. Specifically, if the Unpacker is used repeatedly after an error, the process may crash with a segmentation fault (SEGV).

Impact Analysis

The primary impact of this vulnerability is a denial-of-service (DoS) attack. An attacker could cause the process using the vulnerable MessagePack Unpacker to crash repeatedly by triggering errors and reusing the Unpacker, leading to service interruptions.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the MessagePack Python library to version 1.2.1 or later, where the issue has been fixed.

Compliance Impact

The vulnerability in MessagePack prior to version 1.2.1 causes an out-of-bounds read and potential crash (DoS) when reusing the Unpacker after an error. This issue affects availability but does not impact confidentiality or integrity.

Since the vulnerability leads to a denial of service without compromising data confidentiality or integrity, its direct impact on compliance with standards like GDPR or HIPAA—which focus heavily on data protection and privacy—is limited.

However, availability is also a component of many security frameworks, so organizations relying on MessagePack may need to consider the risk of service disruption in their compliance assessments.

Hi! I’m here to help you understand CVE-2026-57585. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70