msgpack vulnerabilities
8 published CVEs name msgpack among the affected products.
- 8Published CVEs8 of them scored
- 8Last 12 monthspublished in the last year
- 0Critical4 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-126366
msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM
msgpack · msgpack-ruby
High7.5 - CVE-2026-114613
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
msgpack · msgpack-python
High7.5 - CVE-2026-90473
msgpack-java through 0.9.12 Integer Overflow via MAP32
msgpack · msgpack-java
Medium6.9 - CVE-2026-90472
msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
msgpack · msgpack-java
Medium6.9 - CVE-2026-72854
msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation
msgpack · msgpack-c
Medium5.8 - CVE-2026-54522
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
msgpack · msgpack-ruby
Low2.1 - CVE-2026-57585
MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error
msgpack · msgpack-python
High7.5 - CVE-2026-21452
MessagePack-Java Vulnerable to Remote Denial of Service via Malicious .msgpack Model File Triggering Unbounded EXT Payload Allocation
msgpack · msgpack-java
High7.5