Executive brief
MessagePack is a popular data serialization format used to exchange information between applications. A flaw in the Python implementation allows an attacker to crash an application by sending malformed data that triggers an error during processing. If the application attempts to reuse the data processor after such an error, it may suffer a service outage or system crash.
Technical details
A vulnerability exists in msgpack-python prior to version 1.2.1 due to improper memory management when reusing an Unpacker object after a failed unpacking operation. Specifically, the library may perform an out-of-bounds read or trigger a use-after-free (CWE-416) condition, resulting in a segmentation fault (SEGV). An attacker can exploit this by providing untrusted input that causes an initial unpacking error; if the application logic subsequently reuses the same Unpacker instance, the process will crash. This is reachable over the network if the application processes external MessagePack streams. The issue is resolved in version 1.2.1, and users are advised to discard Unpacker instances immediately following any error.
Affected products
- msgpack msgpack-python < 1.2.1
Timeline
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-30: disclosed: CVE published to NVD