High severityNVD Advisory· Published Mar 26, 2026· Updated Mar 30, 2026
Denial of service in github.com/shamaton/msgpack
CVE-2026-32284
Description
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/shamaton/msgpack/v2Go | <= 2.4.0 | — |
github.com/shamaton/msgpack/v3Go | <= 3.1.0 | — |
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
6- github.com/advisories/GHSA-h9q6-hc68-35rpghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-32284ghsaADVISORY
- github.com/golang/vulndb/issues/4513ghsaWEB
- github.com/shamaton/msgpack/issues/59ghsaWEB
- pkg.go.dev/vuln/GO-2026-4513ghsaWEB
- securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026ghsaWEB
News mentions
0No linked articles in our index yet.