CVE-2026-114613

What it actually does

The C extension leaks a decoded map value on key rejection under the default strict_map_key=True setting, producing unbounded heap growth on repeated inputs via unpackb or the streaming Unpacker.

Why it matters to the business

Services that deserialize untrusted MessagePack data face denial-of-service through memory exhaustion, causing outages and restarts; the 30-day EPSS rise and four-day-old disclosure increase urgency for dependent applications.

How an attack unfolds

An attacker repeatedly submits crafted MessagePack payloads containing map keys that trigger rejection under strict_map_key=True, exercising the leak path in the C extension until process memory is exhausted.

How to fix it

Upgrade msgpack to version 1.2.3 or later; fall back to the pure-Python implementation where feasible until the update is complete.

How to confirm the fix worked

Confirm msgpack >= 1.2.3 is installed, then replay test vectors that previously triggered the leak and verify absence of memory growth under strict_map_key=True.

Typical attack path

1. Identify endpoints accepting attacker-controlled MessagePack
2. Generate malformed payloads that cause key rejection
3. Deliver payloads repeatedly via unpackb or Unpacker
4. Observe sustained memory growth leading to DoS

How to detect it

Review application and system logs for repeated deserialization errors or warnings from msgpack, correlate with process memory growth metrics, and inspect any custom Unpacker usage.

What your security team should do

• Upgrade msgpack to 1.2.3 across all environments within the next patch cycle
• Inventory code paths that call unpackb or Unpacker on untrusted data
• Add memory-usage monitoring and alerting for affected processes
• Consider rate-limiting or input validation on deserialization endpoints