[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
msgpack (changelog)	==1.0.4 → ==1.2.3

---

MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error

GHSA-6v7p-g79w-8964

More information

Details

Impact

If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV.

If the Unpacker is used repeatedly to unpack untrusted input from external sources, it may be vulnerable to a DoS attack.

Patches

v1.2.1

Workarounds

Users should create a new Unpacker instead of reusing the same Unpacker after an error occurs.

Applying the above patch can prevent SEGV, but reusing the Streaming Unpacker after it has encountered an error will not yield correct data. If an error occurs during Streaming Unpacking, the Stream and Streaming Unpacker should be discarded.

Therefore, this is not just a workaround but the correct solution. The above patch only prevents crashes from incorrect usage.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
• https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d
• https://github.com/msgpack/msgpack-python/releases/tag/v1.2.1
• https://github.com/advisories/GHSA-6v7p-g79w-8964

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure

CVE-2026-114613 / GHSA-j586-36cw-2gc2

More information

Details

Impact

The msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests.

The report measured approximately 4 MiB retained per failed parse and 100 MiB after 25 failed parses on Windows with Python 3.14 and msgpack 1.2.2. These are reporter-provided results.

Additional impact: stale parser-stack references

The reference-ownership audit performed while fixing this leak found an
additional memory-safety issue in the streaming Unpacker.

After unpack() completed a nested container, an inactive parser-stack slot
could retain a non-owning pointer to the decoded object. A subsequent skip()
could reactivate that slot. If parsing then failed, context cleanup treated the
stale pointer as an owned reference and decremented it.

This corrupts the object's reference count and can result in a use-after-free
or double Py_DECREF when its actual owners later release it.

Although few users use this API, but those who do may experience crashes or unexpected errors due to a use-after-free.

Details

In msgpack/unpack.h, unpack_callback_map_item() rejects keys that are neither str nor bytes. At this point the map value has already been constructed. The early error return does not release the value reference.

In msgpack/unpack_template.h, the value is held in the local obj in unpack_execute(). The CT_MAP_VALUE error path jumps to _failed without decrementing that reference. Cleanup of the parser stack does not recover the value because it is not stored in the stack. The fallback checks the key before decoding the value.

Affected versions

The report reproduces the issue on 1.2.2 and reports it on development commit 475c1b7. The affected-product field lists the reproduced release only; it is not a claim that earlier releases are unaffected.

The earliest affected release needs confirmation: the report's summary says 1.1.x through 1.2.2, while its root-cause analysis attributes introduction to commit cd81370 (PR #​673). Resolve this discrepancy before publishing a definitive affected-version range.

Reproduction

Run in a disposable local process with the C extension installed:

import msgpack

payload = msgpack.packb({42: b"A" * (4 * 1024 * 1024)}, use_bin_type=True)
msgpack.unpackb(payload)  # Raises ValueError; the report observes a 4 MiB leak.

Streaming API trigger:

import msgpack

payload = msgpack.packb({42: b"A" * (4 * 1024 * 1024)}, use_bin_type=True)
u = msgpack.Unpacker()
u.feed(payload)
list(u)  # Same strict_map_key error path.

Workarounds

The pure-Python fallback is reported not to leak on this path and may be used as a temporary workaround after application compatibility and performance checks. Request-size and rate limits may reduce the impact but do not eliminate cumulative leakage.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2
• https://nvd.nist.gov/vuln/detail/CVE-2026-114613
• https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141
• https://github.com/msgpack/msgpack-python/releases/tag/v1.2.3
• https://github.com/advisories/GHSA-j586-36cw-2gc2

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

msgpack/msgpack-python (msgpack)

v1.2.3

Compare Source

Release Date: 2026-09-29

• Fix memory leaks in the C extension when map key validation or container hooks fail.
  See GHSA-j586-36cw-2gc2.
• Fix use-after-free errors when cleaning up an incomplete or failed Unpacker.skip()
  after previously unpacking a nested object in the C extension.
• Raise ValueError in the C extension when switching between unpacking, skipping,
  header readers, or read_bytes() while an object is incomplete. Resume with the
  same method after feeding more data; unpack() and iteration remain interchangeable.
• Prevent reentrant unpacking, header reads, read_bytes(), and reinitialization
  of the same C Unpacker while unpacking is in progress.
• Reject negative sizes in Packer.pack_array_header() and Packer.pack_map_header(). #​742
• Support packing Python 3.15 frozendict objects. #​738
• Update Cython from 3.2.5 to 3.3.0. #​738
• Build wheels for Pyodide using Emscripten. #​732
• Update cibuildwheel to 4.2.1 and the QEMU setup action to 4.4.0. #​741

v1.2.2

Compare Source

Release Date: 2026-08-27

• Fix the read_size documentation. #​700
• Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #​701
• Prevent reentrant calls to Unpacker.feed() while unpacking. #​704
• Improve error handling and reporting in unpacking functions. #​707
• Fix Timestamp.from_datetime() precision for far-future datetimes. #​710
• Fix typos in the documentation. #​712
• Validate the nanoseconds range when unpacking timestamps in the C extension. #​716
• Fix a use-after-free in the unpackb() ExtraData path for non-contiguous input. #​722
• Prevent a buffer overflow when converting Packer's buf_size. #​726
• Translate RecursionError to StackError in the fallback Unpacker.skip(). #​727
• Raise OverflowError when use_single_float=True cannot represent a value. #​728

v1.2.1

Compare Source

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure.
But note that reusing the same Unpacker instance after an unpacking failure is not supported.
Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

v1.2.0

Compare Source

Release Date: 2026-06-11

• Support free threaded Python. #​654, #​686
• Dropped support for Python 3.9. #​656
• Fix missing error checks in C code. #​665, #​666, #​667, #​672
• Fix strict_map_key option didn't work for object_pairs_hook. #​673
• Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #​676
• Fix memory leak when Unpacker returns error for invalid input. #​671
• Fix Packer.pack_ext_type() ignored autoreset option. #​663
• Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #​662
• Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #​677
• Fix possible memory leak when calling Unpacker.__init__() several times. #​687

v1.1.2

Compare Source

Release Date: 2025-10-08

This release does not change source code. It updates only building
wheels:

• Update Cython to v3.1.4
• Update cibuildwheel to v3.2.0
• Drop Python 3.8
• Add Python 3.14
• Add windows-arm

v1.1.1

Compare Source

Release Date: 2025-06-13

• No change from 1.1.1rc1.

v1.1.0

Compare Source

Release Date: 2024-09-10

• use PyLong_* instead of PyInt_* for compatibility with future
  Cython. (#​620)

v1.0.8

Compare Source

Release Date: 2024-03-01

• Update Cython to 3.0.8. This fixes memory leak when iterating
  Unpacker object on Python 3.12.
• Do not include C/Cython files in binary wheels.

v1.0.7

Compare Source

Release Date: 2023-09-28

• Fix build error of extension module on Windows. (#​567)
• setup.py doesn't skip build error of extension module. (#​568)

v1.0.6

Compare Source

Release Date: 2023-09-21

[!NOTE]
v1.0.6 Wheels for Windows don't contain extension module. Please
upgrade to v1.0.7 or newer.

• Add Python 3.12 wheels (#​517)
• Remove Python 2.7, 3.6, and 3.7 support

v1.0.5

Compare Source

Release Date: 2023-03-08

• Use __BYTE_ORDER__ instead of __BYTE_ORDER for portability. (#​513,
  #​514)
• Add Python 3.11 wheels (#​517)
• fallback: Fix packing multidimensional memoryview (#​527)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.