shamaton github.com/shamaton/msgpack/v2 vulnerabilities

Latest shamaton github.com/shamaton/msgpack/v2 CVEs

Newest publication first

1. CVE-2026-32284 Denial of service in github.com/shamaton/msgpack

   Published 2026-03-26

   High·CVSS 7.5 EPSS 0.43%

   The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.

2. CVE-2022-41719 Panic in github.com/shamaton/msgpack/v2

   Published 2022-11-10

   High·CVSS 7.5 EPSS 1.4%

   Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.