Summary
msgpack5: Truncated map32 headers throw an unexpected error
Advisory details
Impact
A truncated map32 header causes an out-of-bounds buffer read and throws RangeError instead of IncompleteBufferError. Applications that rely on IncompleteBufferError to wait for additional bytes may terminate a request, stream, or worker unexpectedly. No adjacent memory is disclosed because the buffer implementation checks bounds.
Patches
The decoder now validates the complete five-byte map32 header before reading its length and reports truncated input as IncompleteBufferError.
Workarounds
Require at least five bytes before decoding a value beginning with 0xdf, or catch RangeError and treat it as incomplete input only for truncated map32 headers.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-102941
gomarkdown/markdown IsSafeURL panics on short URLs
- HIGHCVE-2026-96232
Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability
- MEDIUMCVE-2026-107220
Excelize: Panic in cellInRange on a worksheet with an empty mergeCell ref
- MEDIUMCVE-2026-102820
pageant: Out-of-bounds read / oversized allocation in `pageant` MemoryMap::read via a malicious Pageant agent (Windows)
- CRITICALGHSA-26w7-cxv4-gfx2
Astro: Remote code execution through AVIF image optimization
- HIGHGHSA-6v7p-g79w-8964
MessagePack for Python (the `msgpack` package) has an out-of-bounds read in versions up to and including 1.2.0. If an `Unpacker` is reused after it has raised and caught an error, it can read out of bounds and crash the process with a segmentation fault. Code that streams untrusted MessagePack through a single long-lived `Unpacker` can therefore be crashed on demand, a denial-of-service risk.