PYSEC-2026-3625

    Dashboard / Vulnerabilities / PYSEC-2026-3625

    PYSEC-2026-3625

    Published: 30 Jun 2026Last Modified: 7 Aug 2026

    Summary:

    Details: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

    References: https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964, https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d

    Affected packages

    Package

    Name: msgpack

    Purl: pkg:pypi/msgpack

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.2.1

    Affected versions

    0.5.0
    0.5.1
    0.5.2
    0.5.3
    0.5.4
    0.5.5
    0.5.6

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High