Msgpack Python
Monthly
Unbounded memory leak in the msgpack-python C extension (msgpack._cmsgpack) allows a remote attacker to exhaust process memory by repeatedly sending malformed MessagePack maps, with approximately 4 MiB retained per failed parse and roughly 100 MiB after 25 failed parses as measured by the reporter. The flaw is triggered when strict_map_key=True (the default) rejects a map key that is neither str nor bytes: the decoded value has already been constructed and is never released, affecting both unpackb() and the streaming Unpacker API in releases up to 1.2.2. No public exploit code or active exploitation is identified in the available data, but the CVSS of 7.5 is availability-only (C:N/I:N/A:H), so impact is limited to denial of service rather than data disclosure or code execution; a public proof-of-concept reference exists in the advisory, though it is not verified as working exploit code.
Unbounded memory leak in the msgpack-python C extension (msgpack._cmsgpack) allows a remote attacker to exhaust process memory by repeatedly sending malformed MessagePack maps, with approximately 4 MiB retained per failed parse and roughly 100 MiB after 25 failed parses as measured by the reporter. The flaw is triggered when strict_map_key=True (the default) rejects a map key that is neither str nor bytes: the decoded value has already been constructed and is never released, affecting both unpackb() and the streaming Unpacker API in releases up to 1.2.2. No public exploit code or active exploitation is identified in the available data, but the CVSS of 7.5 is availability-only (C:N/I:N/A:H), so impact is limited to denial of service rather than data disclosure or code execution; a public proof-of-concept reference exists in the advisory, though it is not verified as working exploit code.