redhat/python-msgpack vulnerabilities

Latest redhat/python-msgpack CVEs

Newest publication first

1. CVE-2026-114613 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

   Published 2026-10-22

   High·CVSS 7.5 EPSS 0.54%

   MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbound...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.