This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-57585 →

DEBIAN-CVE-2026-57585

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a ca...

Original description

The description as published by the source.

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 python-msgpack

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 python-msgpack

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 python-msgpack

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2-3"}]}]

References

advisory security-tracker.debian.org