CVE-2026-114613

{
  "etk_id": "ETK-2026-2484",
  "cve_id": "CVE-2026-114613",
  "display_id": "CVE-2026-114613",
  "ghsa_id": "GHSA-j586-36cw-2gc2",
  "euvd_id": "EUVD-2026-108280",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Memory exhaustion in msgpack-python C extension deserialization",
  "summary": "msgpack-python versions before 1.2.3 can leak memory in the C extension while rejecting invalid map keys during MessagePack deserialization. An attacker able to supply malformed MessagePack input may cause sustained memory growth and deny service, including through unpackb() or the streaming Unpacker API when the C extension is used.",
  "mitigation": "Upgrade msgpack-python to version 1.2.3 or later. Until upgraded, avoid deserializing untrusted MessagePack data with the affected C extension.",
  "vendor": "msgpack",
  "product": "msgpack-python",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "= 1.2.2"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.2.3"
      ],
      "package_name": "msgpack",
      "purl": "pkg:pypi/msgpack"
    }
  ],
  "cwes": [
    401
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 30.292220466666667,
  "t0_at": "2026-10-22T18:22:40.544000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-22T18:22:40.544000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-22T18:22:40.544000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-114613"
    }
  }
}