CVE-2026-57585

MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error

CVSS 7.5 HIGHEPSS 0.3%CWE-416

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.5EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

30 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

msgpack · msgpack-python

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964