High severity7.5NVD Advisory· Published Jun 30, 2026· Updated Aug 6, 2026

CVE-2026-57585

Description

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Pypi/Msgpackinferred
Range: <1.2.1
Package: https://pypi.org/project/msgpack
Msgpack/Messagepack
cpe:2.3:a:msgpack:messagepack:*:*:*:*:*:python:*:*
Range: <1.2.1
Debian/python-msgpackllm-create
Range: <1.2.1
osv-coords
pkg:rpm/opensuse/python-msgpack&distro=openSUSE%20Leap%2016.0
Range: < 1.1.0-160000.3.1

Patches

Vulnerability mechanics

References

github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476dnvdPatch
github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964nvdMitigationVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000