MessagePack Deserialization Vulnerability in Python Implementation

CVE-2026-114613

What is CVE-2026-114613?

The msgpack-python library, specifically its C extension, is susceptible to a deserialization vulnerability that leads to memory leakage when malformed inputs are processed. If a deserialized key, adhering to the strict_map_key setting, is encountered and later rejected, it results in the leakage of decoded map values. This issue can escalate to unbounded memory growth within an application, ultimately resulting in denial of service conditions when exploited with repeated, crafted inputs. Notably, the pure-Python fallback implementation is unaffected by this memory leak. This vulnerability is addressed in version 1.2.3 of the msgpack-python library.

References