{"id":"CVE-2026-57585","aliases":["AZL-91746","BELL-CVE-2026-57585","DEBIAN-CVE-2026-57585","EUVD-2026-40423","GHSA-6v7p-g79w-8964","PYSEC-2026-3625","ROOT-APP-PYPI-GHSA-6v7p-g79w-8964","SUSE-SU-2026:22704-1","SUSE-SU-2026:23169-1","SUSE-SU-2026:3113-1","SUSE-SU-2026:3297-1","SUSE-SU-2026:3932-1","SUSE-SU-2026:4443-1","UBUNTU-CVE-2026-57585","openSUSE-SU-2026:11586-1","openSUSE-SU-2026:21239-1"],"status":"published","title":"MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00488,"percentile":0.4247,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-06-19T21:42:55Z","modified":"2026-11-02T09:15:03Z","fixes":[{"ecosystem":"PyPI","package":"msgpack","fixed_in":["1.2.1"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"python-msgpack","fixed_in":["1.0.5-3"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"py3-msgpack","fixed_in":["1.0.8-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"py3-msgpack","fixed_in":["1.0.8-r2"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"py3-msgpack","fixed_in":["1.2.1-r0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-msgpack","fixed_in":["1.1.2-3"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"msgpack","fixed_in":["1.2.0+aikido.2","1.1.1+aikido.2","1.1.2+aikido.2","1.1.2+aikido.1","1.2.0+aikido.1","1.1.1+aikido.1","1.1.1+aikido.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-msgpack","fixed_in":["1.0.5-2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"python-msgpack","fixed_in":["1.0.5-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150600.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150400.10.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-msgpack","fixed_in":["0.5.6-150100.3.6.1","1.0.7-150600.3.5.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Client Tools 12","package":"python-msgpack-python","fixed_in":["0.4.6-8.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-msgpack","fixed_in":["1.0.7-150600.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-msgpack","fixed_in":["1.2.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"python-msgpack","fixed_in":["1.1.0-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.0"},{"fixed":"1.2.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-3"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.4-r1"},{"fixed":"1.0.8-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"py3-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-r1"},{"fixed":"1.0.8-r2"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.4-r1"},{"fixed":"1.2.1-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-2","1.0.3-3","1.1.2-1","1.1.2-2","1.1.2-3","1.1.2-4","1.2.1-1","1.2.1-2","1.2.1-3"]},{"source":"osv","ecosystem":"Debian:13","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-3","1.1.2-1","1.1.2-2","1.1.2-3","1.1.2-4","1.2.1-1","1.2.1-2","1.2.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3"}]}],"versions":["1.0.3-3","1.1.2-1","1.1.2-2"]},{"source":"osv","ecosystem":"PyPI","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"versions":["0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.0","0.6.1","0.6.2","1.0.0","1.0.0rc1","1.0.1","1.0.2","1.0.3","1.0.3rc1","1.0.4","1.0.4rc1","1.0.5","1.0.5rc1","1.0.6","1.0.6rc1","1.0.7","1.0.8","1.1.0","1.1.0rc1","1.1.0rc2","1.1.1","1.1.1rc1","1.1.2","1.2.0","1.2.0rc1"]},{"source":"osv","ecosystem":"PyPI","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1"}]}],"versions":["0.5.0","0.5.1","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.6.0","0.6.1","0.6.2","1.0.0","1.0.0rc1","1.0.1","1.0.2","1.0.3","1.0.3rc1","1.0.4","1.0.4rc1","1.0.5","1.0.5rc1","1.0.6","1.0.6rc1","1.0.7","1.0.8","1.1.0","1.1.0rc1","1.1.0rc2","1.1.1","1.1.1rc1","1.1.2","1.2.0","1.2.0rc1"]},{"source":"osv","ecosystem":"Root:PyPI","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0+aikido.2"},{"fixed":"1.1.1+aikido.2"},{"fixed":"1.1.2+aikido.2"},{"fixed":"1.1.2+aikido.1"},{"fixed":"1.2.0+aikido.1"},{"fixed":"1.1.1+aikido.1"},{"fixed":"1.1.1+aikido.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.5-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.6-150100.3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Client Tools 12","package":"python-msgpack-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.6-8.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150400.10.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150600.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150600.3.5.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.7-150600.3.5.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-2","1.5.4-1","1.5.4-1ubuntu1","1.5.4-1ubuntu3","1.5.4-1ubuntu4","1.5.4-1ubuntu4+esm1","1.5.4-1ubuntu4+esm2","1.5.4-1ubuntu4+esm3","1.5.4-1ubuntu4+esm4","1.5.4-1ubuntu4+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.6-7ubuntu1","1.5.6-7ubuntu2","8.0.2-7","8.0.3-1","8.0.3-2","8.1.0-1","8.1.0-2","8.1.1-1","8.1.1-2","8.1.1-2ubuntu0.1","8.1.1-2ubuntu0.2","8.1.1-2ubuntu0.4","8.1.1-2ubuntu0.6","8.1.1-2ubuntu0.6+esm2","8.1.1-2ubuntu0.6+esm3","8.1.1-2ubuntu0.6+esm4","8.1.1-2ubuntu0.6+esm5","8.1.1-2ubuntu0.6+esm6","8.1.1-2ubuntu0.6+esm8","8.1.1-2ubuntu0.6+esm10","8.1.1-2ubuntu0.6+esm11","8.1.1-2ubuntu0.6+esm12"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.4-0ubuntu2","0.5.6-0ubuntu1","0.5.6-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.0.1-2","9.0.1-2.3~ubuntu1","9.0.1-2.3~ubuntu1.18.04.1","9.0.1-2.3~ubuntu1.18.04.2","9.0.1-2.3~ubuntu1.18.04.3","9.0.1-2.3~ubuntu1.18.04.4","9.0.1-2.3~ubuntu1.18.04.5","9.0.1-2.3~ubuntu1.18.04.5+esm2","9.0.1-2.3~ubuntu1.18.04.5+esm3","9.0.1-2.3~ubuntu1.18.04.6","9.0.1-2.3~ubuntu1.18.04.6+esm1","9.0.1-2.3~ubuntu1.18.04.7","9.0.1-2.3~ubuntu1.18.04.7+esm1","9.0.1-2.3~ubuntu1.18.04.8","9.0.1-2.3~ubuntu1.18.04.8+esm1","9.0.1-2.3~ubuntu1.18.04.8+esm2","9.0.1-2.3~ubuntu1.18.04.8+esm4","9.0.1-2.3~ubuntu1.18.04.8+esm6","9.0.1-2.3~ubuntu1.18.04.8+esm7","9.0.1-2.3~ubuntu1.18.04.8+esm8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.5.6-1build2","0.5.6-1ubuntu1","0.5.6-2","0.5.6-3","0.5.6-3build1","0.6.2-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["18.1-5","18.1-5build1","18.1-5ubuntu1","20.0.2-2","20.0.2-4","20.0.2-5","20.0.2-5ubuntu1","20.0.2-5ubuntu1.1","20.0.2-5ubuntu1.3","20.0.2-5ubuntu1.4","20.0.2-5ubuntu1.5","20.0.2-5ubuntu1.6","20.0.2-5ubuntu1.7","20.0.2-5ubuntu1.8","20.0.2-5ubuntu1.9","20.0.2-5ubuntu1.10","20.0.2-5ubuntu1.10+esm2","20.0.2-5ubuntu1.11","20.0.2-5ubuntu1.11+esm2","20.0.2-5ubuntu1.11+esm3","20.0.2-5ubuntu1.11+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-6build1","1.0.0-6build2","1.0.2-2","1.0.3-1","1.0.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1","22.0.2+dfsg-1ubuntu0.2","22.0.2+dfsg-1ubuntu0.3","22.0.2+dfsg-1ubuntu0.4","22.0.2+dfsg-1ubuntu0.5","22.0.2+dfsg-1ubuntu0.6","22.0.2+dfsg-1ubuntu0.7","22.0.2+dfsg-1ubuntu0.7+esm1","22.0.2+dfsg-1ubuntu0.7+esm2","22.0.2+dfsg-1ubuntu0.7+esm3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-3","1.0.3-3build1","1.0.3-3build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-srsly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.5-1build1","2.4.5-1build2","2.4.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.2+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-1ubuntu1","24.0+dfsg-1ubuntu1.1","24.0+dfsg-1ubuntu1.2","24.0+dfsg-1ubuntu1.3","24.0+dfsg-1ubuntu1.3+esm1","24.0+dfsg-1ubuntu1.3+esm2","24.0+dfsg-1ubuntu1.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-3build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.0+dfsg-1","25.1.1+dfsg-1","25.1.1+dfsg-1ubuntu1","25.1.1+dfsg-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"python-srsly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.2-2build1","1.1.2-4"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","26.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"python-srsly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.3-3build4","1.0.3-3build5","1.1.2-1","1.1.2-2","1.1.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"python-srsly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.1-1","2.5.2-2","2.5.2-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["25.1.1+dfsg-1ubuntu2","25.1.1+dfsg-1ubuntu2+esm1","25.1.1+dfsg-1ubuntu2+esm2","25.1.1+dfsg-1ubuntu2+esm3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-160000.3.1"}]}]}],"products":[{"vendor":"msgpack","product":"messagepack"},{"vendor":"msgpack","product":"msgpack-python"}],"references":[{"url":"https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964","tags":["x_refsource_CONFIRM","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d","tags":["x_refsource_MISC","Patch","fix","web","report"]},{"url":"https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-6v7p-g79w-8964"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57585","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-57585","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/57xxx/CVE-2026-57585.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-57585","tags":["advisory"]},{"url":"https://github.com/msgpack/msgpack-python","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622704-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1269947","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-57585","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623169-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263113-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263297-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263932-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264443-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-57585","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-57585","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-57585","title":"MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T21:36:23.418Z","modified":"2026-07-01T14:54:36.191Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:43:44.898272Z"}],"euvd":[{"id":"EUVD-2026-40423","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T21:36:23Z","modified":"2026-07-01T14:54:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:19.829772Z"}],"ghsa":[{"id":"GHSA-6v7p-g79w-8964","title":"MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error","description":"### Impact\n\nIf the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.\n\nIf the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.\n\n### Patches\n\nv1.2.1\n\n### Workarounds\n\nUsers should create a new Unpacker instead of reusing the same Unpacker after an error occurs.\n\nApplying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.\n\nTherefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.","status":"published","published":"2026-06-19T21:42:55Z","modified":"2026-07-31T06:53:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-57585","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T22:16:57.837Z","modified":"2026-10-25T21:10:00.77Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:26.866638Z"}],"osv":[{"id":"BELL-CVE-2026-57585","status":"published","published":"2026-07-04T06:04:34.54032Z","modified":"2026-07-17T07:15:10.670718927Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:24.657778Z"},{"id":"CVE-2026-57585","title":"MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T21:36:23.418Z","modified":"2026-10-28T11:18:03.509468188Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-57585","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T22:16:57.837Z","modified":"2026-10-26T12:02:37.529744898Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"GHSA-6v7p-g79w-8964","title":"MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error","description":"### Impact\n\nIf the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.\n\nIf the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.\n\n### Patches\n\nv1.2.1\n\n### Workarounds\n\nUsers should create a new Unpacker instead of reusing the same Unpacker after an error occurs.\n\nApplying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.\n\nTherefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.","status":"published","published":"2026-06-19T21:42:55Z","modified":"2026-09-10T03:51:07.975753919Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"PYSEC-2026-3625","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T22:16:57.837Z","modified":"2026-08-07T09:45:09.966898625Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:56.847083Z"},{"id":"UBUNTU-CVE-2026-57585","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T22:16:00Z","modified":"2026-10-17T12:59:12.760561843Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"AZL-91746","title":"CVE-2026-57585 affecting package python-msgpack for versions less than 1.0.5-3","description":"MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack.  If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.","status":"published","published":"2026-06-30T22:16:57Z","modified":"2026-10-31T15:02:25Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"openSUSE-SU-2026:11586-1","title":"python313-msgpack-1.2.1-1.1 on GA media","description":"These are all security issues fixed in the python313-msgpack-1.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-24T00:00:00Z","modified":"2026-08-26T18:23:38.08058888Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21239-1","title":"Security update for python-msgpack","description":"This update for python-msgpack fixes the following issue\n\n- CVE-2026-57585: reusing an Unpacker instance after an error has been caught can lead to an out-of-bounds read\n  (bsc#1269947).\n","status":"published","published":"2026-07-05T18:50:52Z","modified":"2026-07-09T18:24:13.921122614Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"ROOT-APP-PYPI-GHSA-6v7p-g79w-8964","title":"GHSA-6v7p-g79w-8964 in msgpack - Patched by Root","description":"Root has patched GHSA-6v7p-g79w-8964 in the msgpack package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-02T08:05:19Z","modified":"2026-11-02T09:15:03.359319936Z","updated_at":"2026-11-02T15:53:28.259095Z"},{"id":"SUSE-SU-2026:22704-1","title":"Security update for python-msgpack","description":"This update for python-msgpack fixes the following issue\n\n- CVE-2026-57585: reusing an Unpacker instance after an error has been caught can lead to an out-of-bounds read\n  (bsc#1269947).\n","status":"published","published":"2026-07-08T10:55:53Z","modified":"2026-07-23T18:24:14.786693411Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23169-1","title":"Security update for python-msgpack","description":"This update for python-msgpack fixes the following issue\n\n- CVE-2026-57585: `Unpacker` reuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).\n","status":"published","published":"2026-08-06T13:56:08Z","modified":"2026-08-22T18:23:34.617209325Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:3113-1","title":"Security update for python-msgpack","description":"This update for python-msgpack fixes the following issue\n\n- CVE-2026-57585: `Unpacker` reuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).\n","status":"published","published":"2026-07-17T14:24:33Z","modified":"2026-07-18T08:45:13.877775045Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3297-1","title":"Security update for python-msgpack-python","description":"This update for python-msgpack-python fixes the following issue:\n\n- CVE-2026-57585: `Unpacker` reuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).\n","status":"published","published":"2026-07-27T16:47:54Z","modified":"2026-07-28T10:00:10.452190545Z","updated_at":"2026-11-02T15:54:04.987808Z"},{"id":"SUSE-SU-2026:3932-1","title":"Security update for python-msgpack","description":"This update for python-msgpack fixes the following issue:\n\n- CVE-2026-57585: reusing an Unpacker instance after an error has been caught can lead to an out-of-bounds read\n  (bsc#1269947).\n","status":"published","published":"2026-09-03T07:21:02Z","modified":"2026-09-10T18:23:17.868029869Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4443-1","title":"Security update for python-msgpack","description":"This update for python-msgpack fixes the following issue\n\n- CVE-2026-57585: `Unpacker` reuse after a caught error can lead to an out-of-bounds read and a crash (bsc#1269947).\n","status":"published","published":"2026-10-05T08:18:49Z","modified":"2026-10-05T18:00:05.54444495Z","updated_at":"2026-11-02T15:54:05.838224Z"}]}}