CVE-2026-32284: msgpack Decoder DoS Vulnerability

CVE-2026-32284 Overview

CVE-2026-32284 is an out-of-bounds read vulnerability in the msgpack decoder that occurs when processing truncated fixext data. The decoder fails to properly validate the input buffer length when handling format codes 0xd4-0xd8, which represent fixed-length extension types in the MessagePack specification. This insufficient bounds checking can lead to an out-of-bounds read and subsequent runtime panic, enabling denial of service attacks against applications using the affected library.

Critical Impact

Attackers can send malformed MessagePack data with truncated fixext payloads to crash applications, causing service disruption without authentication or user interaction.

Affected Products

• shamaton/msgpack Go library (versions containing the vulnerable decoder)
• Applications using the affected msgpack library for data deserialization
• Services processing untrusted MessagePack input

Discovery Timeline

• 2026-03-26 - CVE-2026-32284 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-32284

Vulnerability Analysis

This vulnerability exists in the MessagePack decoder's handling of fixext format types. MessagePack's fixext formats (0xd4 through 0xd8) are designed to encode extension types with fixed byte lengths (1, 2, 4, 8, and 16 bytes respectively). The vulnerable code path fails to verify that sufficient bytes remain in the input buffer before attempting to read the expected extension data payload.

When a maliciously crafted or truncated MessagePack stream contains a fixext format code followed by fewer bytes than expected, the decoder attempts to read beyond the allocated buffer boundaries. In Go, this triggers a runtime panic due to slice bounds checking, effectively crashing the application.

Root Cause

The root cause is improper input validation in the buffer length checking logic. Before processing fixext format codes, the decoder should verify that the input buffer contains at least the required number of bytes (format byte + type byte + fixed payload length). The absence of this validation allows truncated input to trigger out-of-bounds memory access.

Attack Vector

An attacker can exploit this vulnerability by sending specially crafted MessagePack data to any application that deserializes untrusted input using the affected library. The attack requires:

1. Network access to send malformed MessagePack data to the target application
2. The target application must process the attacker-controlled input through the vulnerable decoder

The attack is straightforward to execute—an attacker simply sends a MessagePack stream containing a fixext format code (e.g., 0xd4) followed by an insufficient number of bytes. When the decoder attempts to read the expected fixed-length payload, it reads beyond buffer boundaries, causing a panic and service crash.

For example, sending a byte sequence like [0xd4, 0x01] (fixext1 format with only the type byte, missing the 1-byte payload) would trigger the vulnerability. Technical details and the fix can be found in the GitHub msgpack Issue #59.

Detection Methods for CVE-2026-32284

Indicators of Compromise

• Application crashes with Go runtime panic messages related to slice bounds
• Error logs showing "index out of range" or "slice bounds out of range" in msgpack decoding functions
• Sudden service restarts or availability issues when processing external data

Detection Strategies

• Monitor application logs for panic stack traces originating from msgpack decoder functions
• Implement anomaly detection for unusual application restart patterns
• Deploy input validation at ingress points to detect malformed MessagePack headers
• Use fuzzing tools to test MessagePack parsing code paths during security assessments

Monitoring Recommendations

• Configure alerting on application crash rates and restart frequency
• Monitor for repeated panic events in Go applications processing MessagePack data
• Track network traffic patterns for abnormally small MessagePack payloads with extension format codes

How to Mitigate CVE-2026-32284

Immediate Actions Required

• Review applications for usage of the shamaton/msgpack library
• Update to a patched version of the msgpack library when available
• Consider implementing input validation before passing data to the msgpack decoder
• Deploy rate limiting to reduce the impact of denial of service attempts

Patch Information

Security updates and patch information are being tracked in the Go vulnerability database. Refer to the Go.dev Security Vulnerability GO-2026-4513 for the latest patching guidance and the GitHub VulnDB Issue #4513 for additional details.

Organizations should update to a fixed version of the library as soon as patches become available through normal dependency update channels.

Workarounds

• Validate MessagePack input length before processing to ensure complete payloads
• Implement recovery handlers around msgpack decoding to catch panics and prevent application crashes
• Deploy a reverse proxy or WAF to filter potentially malicious MessagePack payloads
• Isolate MessagePack processing in separate goroutines with panic recovery

Implementing panic recovery around deserialization code can help maintain service availability:

// Panic recovery wrapper for msgpack decoding
func safeDecode(data []byte, v interface{}) error {
    defer func() {
        if r := recover(); r != nil {
            log.Printf("Recovered from msgpack decode panic: %v", r)
        }
    }()
    return msgpack.Unmarshal(data, v)
}