Executive brief
The shamaton msgpack library, a Go-based tool for encoding and decoding data, is vulnerable to a flaw that allows an attacker to crash an application. By sending a specially crafted, shortened data packet, an attacker can trigger a system error (panic) that stops the service. This results in a denial-of-service, potentially impacting business operations and service availability.
Technical details
An out-of-bounds read vulnerability exists in the shamaton/msgpack library (v2 and v3) within the ext/time decoder. The root cause is a lack of bounds checking in the ReadSize1 function (and potentially ReadSize2, 4, and 8) when processing fixext format codes (0xd4-0xd8). Specifically, the decoder attempts to access buf[1] without verifying that the buffer contains at least two bytes. A remote, unauthenticated attacker can provide a single-byte payload (e.g., 0xd6) to trigger a runtime panic, resulting in a denial of service. As of the advisory date, no official patch has been released, though manual bounds checking in the decoder is recommended as a mitigation.
Affected products
- shamaton msgpack All versions up to 3.1.2
Timeline
- 2026-02-19: disclosed: Vulnerability reported to the maintainer and Go vulnerability database.
- 2026-03-16: advisory: Go vulnerability report GO-2026-4513 published.
- 2026-03-26: advisory: CVE-2026-32284 published to NVD.