p PatchFirst

CVE-2026-57585

CVE-2026-57585 · MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

CVSS 7.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • msgpack-python

    Versions
    • < 1.2.1: Affected

    No fix published

  • python-msgpack Debian:12

    Versions
    • 1.0.3-2
    • 1.0.3-3
    • 1.1.2-1
    • 1.1.2-2
    • 1.1.2-3
    • 1.1.2-4
    • 1.2.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Debian:13

    Versions
    • 1.0.3-3
    • 1.1.2-1
    • 1.1.2-2
    • 1.1.2-3
    • 1.1.2-4
    • 1.2.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Debian:14

    Versions
    • 1.0.3-3
    • 1.1.2-1
    • 1.1.2-2
    Affected ranges
    • ECOSYSTEM: < 1.1.2-3

    Update to 1.1.2-3

  • msgpack PyPI

    Versions
    • 0.5.0
    • 0.5.1
    • 0.5.2
    • 0.5.3
    • 0.5.4
    • 0.5.5
    • 0.5.6
    • 0.6.0
    • 0.6.1
    • 0.6.2
    • 1.0.0
    • 1.0.0rc1
    • 1.0.1
    • 1.0.2
    • 1.0.3
    • 1.0.3rc1
    • 1.0.4
    • 1.0.4rc1
    • 1.0.5
    • 1.0.5rc1
    • 1.0.6
    • 1.0.6rc1
    • 1.0.7
    • 1.0.8
    • 1.1.0
    • 1.1.0rc1
    • 1.1.0rc2
    • 1.1.1
    • 1.1.1rc1
    • 1.1.2
    • 1.2.0
    • 1.2.0rc1
    Affected ranges
    • ECOSYSTEM: < 1.2.1

    Update to 1.2.1

  • python-pip Ubuntu:Pro:14.04:LTS

    Versions
    • 1.4.1-2
    • 1.5.4-1
    • 1.5.4-1ubuntu1
    • 1.5.4-1ubuntu3
    • 1.5.4-1ubuntu4
    • 1.5.4-1ubuntu4+esm1
    • 1.5.4-1ubuntu4+esm2
    • 1.5.4-1ubuntu4+esm3
    • 1.5.4-1ubuntu4+esm4
    • 1.5.4-1ubuntu4+esm5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:16.04:LTS

    Versions
    • 1.5.6-7ubuntu1
    • 1.5.6-7ubuntu2
    • 8.0.2-7
    • 8.0.3-1
    • 8.0.3-2
    • 8.1.0-1
    • 8.1.0-2
    • 8.1.1-1
    • 8.1.1-2
    • 8.1.1-2ubuntu0.1
    • 8.1.1-2ubuntu0.2
    • 8.1.1-2ubuntu0.4
    • 8.1.1-2ubuntu0.6
    • 8.1.1-2ubuntu0.6+esm2
    • 8.1.1-2ubuntu0.6+esm3
    • 8.1.1-2ubuntu0.6+esm4
    • 8.1.1-2ubuntu0.6+esm5
    • 8.1.1-2ubuntu0.6+esm6
    • 8.1.1-2ubuntu0.6+esm8
    • 8.1.1-2ubuntu0.6+esm10
    • 8.1.1-2ubuntu0.6+esm11
    • 8.1.1-2ubuntu0.6+esm12
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Ubuntu:18.04:LTS

    Versions
    • 0.5.4-0ubuntu2
    • 0.5.6-0ubuntu1
    • 0.5.6-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:18.04:LTS

    Versions
    • 9.0.1-2
    • 9.0.1-2.3~ubuntu1
    • 9.0.1-2.3~ubuntu1.18.04.1
    • 9.0.1-2.3~ubuntu1.18.04.2
    • 9.0.1-2.3~ubuntu1.18.04.3
    • 9.0.1-2.3~ubuntu1.18.04.4
    • 9.0.1-2.3~ubuntu1.18.04.5
    • 9.0.1-2.3~ubuntu1.18.04.5+esm2
    • 9.0.1-2.3~ubuntu1.18.04.5+esm3
    • 9.0.1-2.3~ubuntu1.18.04.6
    • 9.0.1-2.3~ubuntu1.18.04.6+esm1
    • 9.0.1-2.3~ubuntu1.18.04.7
    • 9.0.1-2.3~ubuntu1.18.04.7+esm1
    • 9.0.1-2.3~ubuntu1.18.04.8
    • 9.0.1-2.3~ubuntu1.18.04.8+esm1
    • 9.0.1-2.3~ubuntu1.18.04.8+esm2
    • 9.0.1-2.3~ubuntu1.18.04.8+esm4
    • 9.0.1-2.3~ubuntu1.18.04.8+esm6
    • 9.0.1-2.3~ubuntu1.18.04.8+esm7
    • 9.0.1-2.3~ubuntu1.18.04.8+esm8
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Ubuntu:20.04:LTS

    Versions
    • 0.5.6-1build2
    • 0.5.6-1ubuntu1
    • 0.5.6-2
    • 0.5.6-3
    • 0.5.6-3build1
    • 0.6.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:20.04:LTS

    Versions
    • 18.1-5
    • 18.1-5build1
    • 18.1-5ubuntu1
    • 20.0.2-2
    • 20.0.2-4
    • 20.0.2-5
    • 20.0.2-5ubuntu1
    • 20.0.2-5ubuntu1.1
    • 20.0.2-5ubuntu1.3
    • 20.0.2-5ubuntu1.4
    • 20.0.2-5ubuntu1.5
    • 20.0.2-5ubuntu1.6
    • 20.0.2-5ubuntu1.7
    • 20.0.2-5ubuntu1.8
    • 20.0.2-5ubuntu1.9
    • 20.0.2-5ubuntu1.10
    • 20.0.2-5ubuntu1.10+esm2
    • 20.0.2-5ubuntu1.11
    • 20.0.2-5ubuntu1.11+esm2
    • 20.0.2-5ubuntu1.11+esm3
    • 20.0.2-5ubuntu1.11+esm4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Ubuntu:22.04:LTS

    Versions
    • 1.0.0-6build1
    • 1.0.0-6build2
    • 1.0.2-2
    • 1.0.3-1
    • 1.0.3-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:22.04:LTS

    Versions
    • 20.3.4-4
    • 21.3.1+dfsg-3
    • 22.0.2+dfsg-1
    • 22.0.2+dfsg-1ubuntu0.1
    • 22.0.2+dfsg-1ubuntu0.2
    • 22.0.2+dfsg-1ubuntu0.3
    • 22.0.2+dfsg-1ubuntu0.4
    • 22.0.2+dfsg-1ubuntu0.5
    • 22.0.2+dfsg-1ubuntu0.6
    • 22.0.2+dfsg-1ubuntu0.7
    • 22.0.2+dfsg-1ubuntu0.7+esm1
    • 22.0.2+dfsg-1ubuntu0.7+esm2
    • 22.0.2+dfsg-1ubuntu0.7+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Ubuntu:24.04:LTS

    Versions
    • 1.0.3-3
    • 1.0.3-3build1
    • 1.0.3-3build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-srsly Ubuntu:24.04:LTS

    Versions
    • 2.4.5-1build1
    • 2.4.5-1build2
    • 2.4.5-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:Pro:24.04:LTS

    Versions
    • 23.2+dfsg-1
    • 23.3+dfsg-1
    • 24.0+dfsg-1
    • 24.0+dfsg-1ubuntu1
    • 24.0+dfsg-1ubuntu1.1
    • 24.0+dfsg-1ubuntu1.2
    • 24.0+dfsg-1ubuntu1.3
    • 24.0+dfsg-1ubuntu1.3+esm1
    • 24.0+dfsg-1ubuntu1.3+esm2
    • 24.0+dfsg-1ubuntu1.3+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Ubuntu:25.10

    Versions
    • 1.0.3-3build4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:25.10

    Versions
    • 25.0+dfsg-1
    • 25.1.1+dfsg-1
    • 25.1.1+dfsg-1ubuntu1
    • 25.1.1+dfsg-1ubuntu2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-srsly Ubuntu:25.10

    Versions
    • 2.5.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Ubuntu:26.10

    Versions
    • 1.1.2-2build1
    • 1.1.2-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-pip Ubuntu:26.10

    Versions
    • 25.1.1+dfsg-1ubuntu2
    • 26.1.2+dfsg-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-srsly Ubuntu:26.10

    Versions
    • 2.5.2-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-msgpack Ubuntu:26.04:LTS

    Versions
    • 1.0.3-3build4
    • 1.0.3-3build5
    • 1.1.2-1
    • 1.1.2-2
    • 1.1.2-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-srsly Ubuntu:26.04:LTS

    Versions
    • 2.5.1-1
    • 2.5.2-2
    • 2.5.2-2build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →