CVE catalog
CVE-2026-57585
MessagePack is the serializer implementation for…
MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.49% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "python-msgpack",
"status": "fixed",
"release": "sid",
"version": "1.2.1-3"
},
{
"name": "python-msgpack",
"status": "fixed",
"release": "forky",
"version": "1.2.1-1"
},
{
"name": "python-msgpack",
"status": "vulnerable",
"release": "trixie",
"version": "1.0.3-3"
},
{
"name": "python-msgpack",
"status": "vulnerable",
"release": "bookworm",
"version": "1.0.3-2"
}
],
"fixed_versions": [
{
"bug": 1141340,
"name": "python-msgpack",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "1.1.2-3"
},
{
"bug": 1141340,
"name": "python-msgpack",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "1.1.2-3"
},
{
"bug": 1141340,
"name": "python-msgpack",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": ""
},
{
"bug": 1141340,
"name": "python-msgpack",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": ""
}
],
"distribution_packages": [
{
"name": "python-msgpack",
"ecosystem": "cpe",
"fixed_version": "not yet fixed"
},
{
"name": "msgpack",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1"
}
]
}
],
"ecosystem": "PyPI",
"fixed_version": "1.2.1",
"provider_record_id": "PYSEC-2026-3625"
},
{
"name": "msgpack",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1"
}
]
}
],
"ecosystem": "PyPI",
"fixed_version": "1.2.1",
"provider_record_id": "GHSA-6V7P-G79W-8964"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150600.3.5.1"
}
]
}
],
"release": "linux enterprise module for python 3 15 sp7",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150600.3.5.1",
"provider_record_id": "SUSE-SU-2026:4443-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150600.3.5.1"
}
]
}
],
"release": "linux enterprise server 15 sp6-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150600.3.5.1",
"provider_record_id": "SUSE-SU-2026:4443-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150600.3.5.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp6",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150600.3.5.1",
"provider_record_id": "SUSE-SU-2026:4443-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise server 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise server 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.7-150400.10.9.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.7-150400.10.9.1",
"provider_record_id": "SUSE-SU-2026:3932-1"
},
{
"name": "python-msgpack",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.1-1.1"
}
]
}
],
"release": "tumbleweed",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.2.1-1.1",
"provider_record_id": "OPENSUSE-SU-2026:11586-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5-slfo.1.1_2.1"
}
]
}
],
"release": "linux micro 6.1",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.5-slfo.1.1_2.1",
"provider_record_id": "SUSE-SU-2026:23169-1"
},
{
"name": "python-msgpack-python",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.4.6-8.8.1"
}
]
}
],
"release": "manager client tools 12",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.4.6-8.8.1",
"provider_record_id": "SUSE-SU-2026:3297-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.5-2.1"
}
]
}
],
"release": "linux micro 6.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.0.5-2.1",
"provider_record_id": "SUSE-SU-2026:22704-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise micro 5.3",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise micro 5.4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise micro 5.5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise module for public cloud 15 sp7",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-espos",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise high performance computing 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise server 15 sp4-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise server 15 sp5-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise server 15 sp6-ltss",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.5.6-150100.3.6.1"
}
]
}
],
"release": "linux enterprise server for sap applications 15 sp6",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.5.6-150100.3.6.1",
"provider_record_id": "SUSE-SU-2026:3113-1"
},
{
"name": "python-msgpack",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.0-160000.3.1"
}
]
}
],
"release": "leap 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "1.1.0-160000.3.1",
"provider_record_id": "OPENSUSE-SU-2026:21239-1"
},
{
"name": "messagepack",
"ranges": [
{
"fixed": "1.2.1",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "1.2.1",
"provider_record_id": "NVD-CVE-2026-57585"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [python3-msgpack]Unknown
Source package: [python-msgpack]
Details (2)
1.0.3-2+b1· amd64 · bookwormAffected
nvd · python-msgpack · debian · bookworm; nvd · python-msgpack · debian · 12
1.0.3-2+b1· arm64 · bookwormAffected
nvd · python-msgpack · debian · bookworm; nvd · python-msgpack · debian · 12
[Debian 13 (Trixie)]
- [python3-msgpack]Unknown
Source package: [python-msgpack]
Details (2)
1.0.3-3+b4· amd64 · trixieAffected
nvd · python-msgpack · debian · 13
1.0.3-3+b5· arm64 · trixieAffected
nvd · python-msgpack · debian · 13
[openSUSE Tumbleweed]
- [python313-msgpack]Unknown
Source package: [python-msgpack]
Details (1)
1.2.1-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.2.1-1.1Version impact unknown
nvd · python-msgpack · opensuse · tumbleweed
- [python314-msgpack]Unknown
Source package: [python-msgpack]
Details (1)
1.2.1-1.1· x86_64 · tumbleweedUnknown · Fixed:
1.2.1-1.1Version impact unknown
nvd · python-msgpack · opensuse · tumbleweed
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:73929]
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21239-1.json]
- [https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d]
- [https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-57585]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-57585]
- [https://osv.dev/vulnerability/GHSA-6v7p-g79w-8964]
- [https://osv.dev/vulnerability/SUSE-SU-2026:22704-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23169-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3113-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3297-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3932-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:4443-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:11586-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21239-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-57585]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]