{"id":"CVE-2022-41719","aliases":["EUVD-2022-7376","GHSA-jr77-8gx4-h5qh","GO-2022-0972"],"status":"published","title":"Panic in github.com/shamaton/msgpack/v2","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01355,"percentile":0.7182,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-11-10T19:55:07Z","modified":"2026-10-28T02:31:07Z","fixes":[{"ecosystem":"Go","package":"github.com/shamaton/msgpack/v2","fixed_in":["2.1.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/shamaton/msgpack/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/shamaton/msgpack/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/shamaton/msgpack/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.1"}]}]}],"products":[{"vendor":"github.com/shamaton/msgpack/v2","product":"github.com/shamaton/msgpack/v2"},{"vendor":"messagepack_project","product":"messagepack"}],"references":[{"url":"https://github.com/shamaton/msgpack/issues/31","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report","web"]},{"url":"https://github.com/shamaton/msgpack/pull/32","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://pkg.go.dev/vuln/GO-2022-0972","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41719","tags":["advisory"]},{"url":"https://github.com/shamaton/msgpack/releases/tag/v2.1.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jr77-8gx4-h5qh"},{"url":"https://pkg.go.dev","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41719.json","tags":["advisory"]},{"url":"https://github.com/shamaton/msgpack","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-41719","title":"Panic in github.com/shamaton/msgpack/v2","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.","status":"published","published":"2022-11-10T19:57:01.274Z","modified":"2025-04-30T19:46:41.386Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-7376","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.","status":"published","published":"2022-11-10T19:57:01Z","modified":"2025-04-30T19:46:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:51:58.556756Z"}],"ghsa":[{"id":"GHSA-jr77-8gx4-h5qh","title":"MessagePack for Golang subject to DoS via Unmarshal panic","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.","status":"published","published":"2022-11-11T12:00:33Z","modified":"2023-08-30T00:03:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:02.095916Z"}],"nvd":[{"id":"CVE-2022-41719","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.","status":"published","published":"2022-11-10T20:15:12.187Z","modified":"2026-06-17T05:03:42.343Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"CVE-2022-41719","title":"Panic in github.com/shamaton/msgpack/v2","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.","status":"published","published":"2022-11-10T19:57:01.274Z","modified":"2026-10-28T02:31:07.756935875Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:26.860704Z"},{"id":"GHSA-jr77-8gx4-h5qh","title":"MessagePack for Golang subject to DoS via Unmarshal panic","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.","status":"published","published":"2022-11-11T12:00:33Z","modified":"2023-11-08T04:10:32.235022Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"GO-2022-0972","title":"Panic in github.com/shamaton/msgpack/v2","description":"Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.","status":"published","published":"2022-11-10T19:55:07Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}