CVE-2026-57585
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
CVE-2026-57585- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2026-40423
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
EUVD-2026-40423- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6v7p-g79w-8964
MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
Impact
If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.
If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.
Patches
v1.2.1
Workarounds
Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.
Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.
Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.
- Record
GHSA-6v7p-g79w-8964- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
CVE-2026-57585- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVBELL-CVE-2026-57585
- Record
BELL-CVE-2026-57585- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
CVE-2026-57585- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
Show 14 moreShow less
OSVDEBIAN-CVE-2026-57585
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
DEBIAN-CVE-2026-57585- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-6v7p-g79w-8964
MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
Impact
If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.
If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.
Patches
v1.2.1
Workarounds
Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.
Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.
Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.
- Record
GHSA-6v7p-g79w-8964- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVPYSEC-2026-3625
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
PYSEC-2026-3625- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-57585
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
UBUNTU-CVE-2026-57585- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-91746 No score
CVE-2026-57585 affecting package python-msgpack for versions less than 1.0.5-3
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Record
AZL-91746- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11586-1 No score
python313-msgpack-1.2.1-1.1 on GA media
These are all security issues fixed in the python313-msgpack-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11586-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21239-1 No score
Security update for python-msgpack
This update for python-msgpack fixes the following issue
- CVE-2026-57585: reusing an Unpacker instance after an error has been caught can lead to an out-of-bounds read (bsc#1269947).
- Record
openSUSE-SU-2026:21239-1- Updated
- 2026-11-02
OSVROOT-APP-PYPI-GHSA-6v7p-g79w-8964 No score
GHSA-6v7p-g79w-8964 in msgpack - Patched by Root
Root has patched GHSA-6v7p-g79w-8964 in the msgpack package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-GHSA-6v7p-g79w-8964- Updated
- 2026-11-02
OSVSUSE-SU-2026:22704-1 No score
Security update for python-msgpack
This update for python-msgpack fixes the following issue
- CVE-2026-57585: reusing an Unpacker instance after an error has been caught can lead to an out-of-bounds read (bsc#1269947).
- Record
SUSE-SU-2026:22704-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23169-1 No score
Security update for python-msgpack
This update for python-msgpack fixes the following issue
- CVE-2026-57585:
Unpackerreuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).
- Record
SUSE-SU-2026:23169-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3113-1 No score
Security update for python-msgpack
This update for python-msgpack fixes the following issue
- CVE-2026-57585:
Unpackerreuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).
- Record
SUSE-SU-2026:3113-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3297-1 No score
Security update for python-msgpack-python
This update for python-msgpack-python fixes the following issue:
- CVE-2026-57585:
Unpackerreuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).
- Record
SUSE-SU-2026:3297-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:3932-1 No score
Security update for python-msgpack
This update for python-msgpack fixes the following issue:
- CVE-2026-57585: reusing an Unpacker instance after an error has been caught can lead to an out-of-bounds read (bsc#1269947).
- Record
SUSE-SU-2026:3932-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4443-1 No score
Security update for python-msgpack
This update for python-msgpack fixes the following issue
- CVE-2026-57585:
Unpackerreuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).
- Record
SUSE-SU-2026:4443-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
msgpackPyPI |
through 1.2.0 | 1.2.1 |
python-msgpackAzure Linux:3 |
before 1.0.5-3 | 1.0.5-3 |
py3-msgpackAlpaquita:23 |
1.0.4-r1 up to 1.0.8-r0 | 1.0.8-r0 |
py3-msgpackAlpaquita:25 |
1.0.8-r1 up to 1.0.8-r2 | 1.0.8-r2 |
py3-msgpackAlpaquita:stream |
1.0.4-r1 up to 1.2.1-r0 | 1.2.1-r0 |
python-msgpackDebian:12 |
All versions, plus listed versions 1.0.3-21.0.3-31.1.2-11.1.2-21.1.2-3 Show 4 moreShow less1.1.2-41.2.1-11.2.1-21.2.1-3 |
None known |
python-msgpackDebian:13 |
All versions, plus listed versions 1.0.3-31.1.2-11.1.2-21.1.2-31.1.2-41.2.1-11.2.1-21.2.1-3 |
None known |
python-msgpackDebian:14 |
before 1.1.2-3, plus listed versions 1.0.3-31.1.2-11.1.2-2 |
1.1.2-3 |
msgpackPyPI |
before 1.2.1, plus listed versions 0.5.00.5.10.5.20.5.30.5.4 Show 27 moreShow less0.5.50.5.60.6.00.6.10.6.21.0.01.0.0rc11.0.11.0.21.0.31.0.3rc11.0.41.0.4rc11.0.51.0.5rc11.0.61.0.6rc11.0.71.0.81.1.01.1.0rc11.1.0rc21.1.11.1.1rc11.1.21.2.01.2.0rc1 |
1.2.1 |
msgpackRoot:PyPI |
before 1.2.0+aikido.2 | 1.2.0+aikido.21.1.1+aikido.21.1.2+aikido.21.1.2+aikido.11.2.0+aikido.11.1.1+aikido.11.1.1+aikido.3 |
Show 50 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-msgpackSUSE:Linux Micro 6.0 |
before 1.0.5-2.1 | 1.0.5-2.1 |
python-msgpackSUSE:Linux Micro 6.1 |
before 1.0.5-slfo.1.1_2.1 | 1.0.5-slfo.1.1_2.1 |
python-msgpackSUSE:Linux Enterprise Micro 5.3 |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Micro 5.4 |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Micro 5.5 |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Module for Public Cloud 15 SP7 |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpackSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 0.5.6-150100.3.6.1 | 0.5.6-150100.3.6.1 |
python-msgpack-pythonSUSE:Manager Client Tools 12 |
before 0.4.6-8.8.1 | 0.4.6-8.8.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise Server 15 SP5-LTSS |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise Server for SAP Applications 15 SP5 |
before 1.0.7-150400.10.9.1 | 1.0.7-150400.10.9.1 |
python-msgpackSUSE:Linux Enterprise Module for Python 3 15 SP7 |
before 1.0.7-150600.3.5.1 | 1.0.7-150600.3.5.1 |
python-msgpackSUSE:Linux Enterprise Server 15 SP6-LTSS |
before 1.0.7-150600.3.5.1 | 1.0.7-150600.3.5.1 |
python-msgpackSUSE:Linux Enterprise Server for SAP Applications 15 SP6 |
before 1.0.7-150600.3.5.1 | 1.0.7-150600.3.5.1 |
python-pipUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.4.1-21.5.4-11.5.4-1ubuntu11.5.4-1ubuntu31.5.4-1ubuntu4 Show 5 moreShow less1.5.4-1ubuntu4+esm11.5.4-1ubuntu4+esm21.5.4-1ubuntu4+esm31.5.4-1ubuntu4+esm41.5.4-1ubuntu4+esm5 |
None known |
python-pipUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.5.6-7ubuntu11.5.6-7ubuntu28.0.2-78.0.3-18.0.3-2 Show 17 moreShow less8.1.0-18.1.0-28.1.1-18.1.1-28.1.1-2ubuntu0.18.1.1-2ubuntu0.28.1.1-2ubuntu0.48.1.1-2ubuntu0.68.1.1-2ubuntu0.6+esm28.1.1-2ubuntu0.6+esm38.1.1-2ubuntu0.6+esm48.1.1-2ubuntu0.6+esm58.1.1-2ubuntu0.6+esm68.1.1-2ubuntu0.6+esm88.1.1-2ubuntu0.6+esm108.1.1-2ubuntu0.6+esm118.1.1-2ubuntu0.6+esm12 |
None known |
python-msgpackUbuntu:18.04:LTS |
All versions, plus listed versions 0.5.4-0ubuntu20.5.6-0ubuntu10.5.6-1 |
None known |
python-pipUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 9.0.1-29.0.1-2.3~ubuntu19.0.1-2.3~ubuntu1.18.04.19.0.1-2.3~ubuntu1.18.04.29.0.1-2.3~ubuntu1.18.04.3 Show 15 moreShow less9.0.1-2.3~ubuntu1.18.04.49.0.1-2.3~ubuntu1.18.04.59.0.1-2.3~ubuntu1.18.04.5+esm29.0.1-2.3~ubuntu1.18.04.5+esm39.0.1-2.3~ubuntu1.18.04.69.0.1-2.3~ubuntu1.18.04.6+esm19.0.1-2.3~ubuntu1.18.04.79.0.1-2.3~ubuntu1.18.04.7+esm19.0.1-2.3~ubuntu1.18.04.89.0.1-2.3~ubuntu1.18.04.8+esm19.0.1-2.3~ubuntu1.18.04.8+esm29.0.1-2.3~ubuntu1.18.04.8+esm49.0.1-2.3~ubuntu1.18.04.8+esm69.0.1-2.3~ubuntu1.18.04.8+esm79.0.1-2.3~ubuntu1.18.04.8+esm8 |
None known |
python-msgpackUbuntu:20.04:LTS |
All versions, plus listed versions 0.5.6-1build20.5.6-1ubuntu10.5.6-20.5.6-30.5.6-3build10.6.2-1 |
None known |
python-pipUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 18.1-518.1-5build118.1-5ubuntu120.0.2-220.0.2-4 Show 16 moreShow less20.0.2-520.0.2-5ubuntu120.0.2-5ubuntu1.120.0.2-5ubuntu1.320.0.2-5ubuntu1.420.0.2-5ubuntu1.520.0.2-5ubuntu1.620.0.2-5ubuntu1.720.0.2-5ubuntu1.820.0.2-5ubuntu1.920.0.2-5ubuntu1.1020.0.2-5ubuntu1.10+esm220.0.2-5ubuntu1.1120.0.2-5ubuntu1.11+esm220.0.2-5ubuntu1.11+esm320.0.2-5ubuntu1.11+esm4 |
None known |
python-msgpackUbuntu:22.04:LTS |
All versions, plus listed versions 1.0.0-6build11.0.0-6build21.0.2-21.0.3-11.0.3-1build1 |
None known |
python-pipUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 20.3.4-421.3.1+dfsg-322.0.2+dfsg-122.0.2+dfsg-1ubuntu0.122.0.2+dfsg-1ubuntu0.2 Show 8 moreShow less22.0.2+dfsg-1ubuntu0.322.0.2+dfsg-1ubuntu0.422.0.2+dfsg-1ubuntu0.522.0.2+dfsg-1ubuntu0.622.0.2+dfsg-1ubuntu0.722.0.2+dfsg-1ubuntu0.7+esm122.0.2+dfsg-1ubuntu0.7+esm222.0.2+dfsg-1ubuntu0.7+esm3 |
None known |
python-msgpackUbuntu:24.04:LTS |
All versions, plus listed versions 1.0.3-31.0.3-3build11.0.3-3build2 |
None known |
python-srslyUbuntu:24.04:LTS |
All versions, plus listed versions 2.4.5-1build12.4.5-1build22.4.5-1ubuntu1 |
None known |
python-pipUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 23.2+dfsg-123.3+dfsg-124.0+dfsg-124.0+dfsg-1ubuntu124.0+dfsg-1ubuntu1.1 Show 5 moreShow less24.0+dfsg-1ubuntu1.224.0+dfsg-1ubuntu1.324.0+dfsg-1ubuntu1.3+esm124.0+dfsg-1ubuntu1.3+esm224.0+dfsg-1ubuntu1.3+esm3 |
None known |
python-msgpackUbuntu:25.10 |
All versions, plus listed versions 1.0.3-3build4 |
None known |
python-pipUbuntu:25.10 |
All versions, plus listed versions 25.0+dfsg-125.1.1+dfsg-125.1.1+dfsg-1ubuntu125.1.1+dfsg-1ubuntu2 |
None known |
python-srslyUbuntu:25.10 |
All versions, plus listed versions 2.5.1-1 |
None known |
python-msgpackUbuntu:26.10 |
All versions, plus listed versions 1.1.2-2build11.1.2-4 |
None known |
python-pipUbuntu:26.10 |
All versions, plus listed versions 25.1.1+dfsg-1ubuntu226.1.2+dfsg-1 |
None known |
python-srslyUbuntu:26.10 |
All versions, plus listed versions 2.5.2-2build1 |
None known |
python-msgpackUbuntu:26.04:LTS |
All versions, plus listed versions 1.0.3-3build41.0.3-3build51.1.2-11.1.2-21.1.2-2build1 |
None known |
python-srslyUbuntu:26.04:LTS |
All versions, plus listed versions 2.5.1-12.5.2-22.5.2-2build1 |
None known |
python-pipUbuntu:Pro:26.04:LTS |
All versions, plus listed versions 25.1.1+dfsg-1ubuntu225.1.1+dfsg-1ubuntu2+esm125.1.1+dfsg-1ubuntu2+esm225.1.1+dfsg-1ubuntu2+esm3 |
None known |
python-msgpackopenSUSE:Tumbleweed |
before 1.2.1-1.1 | 1.2.1-1.1 |
python-msgpackopenSUSE:Leap 16.0 |
before 1.1.0-160000.3.1 | 1.1.0-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-57585 is a high vulnerability (CVSS 7.5) in Msgpack Messagepack, published June 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in msgpack 1.2.1.
References
github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
nvd.nist.gov/vuln/detail/CVE-2026-57585
docs.bell-sw.com/security/cves/CVE-2026-57585
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2026-57585
suse.com/support/update/announcement/2026/suse-su-202622704-1
bugzilla.suse.com/1269947
ubuntu.com/security/CVE-2026-57585
cve.org/CVERecord?id=CVE-2026-57585