CVE-2026-114613 MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-114613?
CVE-2026-114613 is a high-severity vulnerability in msgpack-python, published on 22 Oct 2026.
Official description
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.
Weakness: CWE-401
Which versions are affected by CVE-2026-114613?
2 open source packages ship an affected version, including msgpack.
| Package | Affected | Fixed in |
|---|---|---|
msgpack PyPI | All versions | 1.2.3 |
msgpack PyPI | All versions | 1.2.3 |
How do I fix CVE-2026-114613?
Upgrade msgpack to 1.2.3 or later.
Is CVE-2026-114613 being exploited?
There is no known exploitation of CVE-2026-114613 in the wild and no public exploit code.
Sources
Also known as AZL-111044, DEBIAN-CVE-2026-114613, ECHO-3ddd-55c2-b818, GHSA-j586-36cw-2gc2, MINI-54jj-x2mq-hf2m, MINI-55vq-gf8w-crh2 and 1 more.