CVE-2026-57585: Python MessagePack DoS Vulnerability

CVE-2026-57585 Overview

CVE-2026-57585 is an out-of-bounds read vulnerability in the MessagePack serializer implementation for Python (msgpack). The flaw affects versions prior to 1.2.1 and occurs when an Unpacker instance is reused after a previous unpacking operation raised an exception. Under this condition, stale references in the internal parser stack can trigger a segmentation fault (SEGV), crashing the process. The issue is classified as [CWE-416] Use After Free and enables a network-reachable denial-of-service condition against any Python service that recycles Unpacker objects across malformed inputs.

Critical Impact
A remote attacker can send crafted MessagePack payloads that cause the Python process to crash with a SEGV, resulting in denial of service without requiring authentication or user interaction.

Affected Products

msgpack-python versions prior to 1.2.1
Python applications and services that reuse Unpacker instances after handling exceptions
Downstream libraries and frameworks bundling vulnerable msgpack releases

Discovery Timeline

2026-06-30 - CVE-2026-57585 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-57585

Vulnerability Analysis

The defect lives in the C-accelerated unpacking path of msgpack-python, specifically in unpack_clear within msgpack/unpack_template.h. When unpack_execute fails midway through parsing a malformed buffer, the parser stack retains partially initialized entries. The pre-patch unpack_clear iterated the stack starting at index 1 and cleared stack[0].obj separately, leaving the parser context in an inconsistent state. Subsequent calls on the same Unpacker then dereferenced stale pointers, producing an out-of-bounds read and a process-terminating SEGV.

Root Cause

The root cause is improper reinitialization of the unpack context after an error path. The stack cleanup skipped index 0 in its loop and did not reset the context counters, so a reused Unpacker began new work with dangling object references and inconsistent top bookkeeping. This satisfies the conditions of a use-after-free ([CWE-416]) on the parser stack objects.

Attack Vector

Exploitation requires only that an attacker can deliver two MessagePack payloads to a service that reuses a single Unpacker instance. The first payload is crafted to raise an exception during parsing; the second, benign or malformed, triggers the crash. Because msgpack is widely used in RPC frameworks, message brokers, and network protocols, the attack vector is network-based and unauthenticated.

// Patch to msgpack/unpack_template.h - fixes stack cleanup and re-initializes context
static inline void unpack_clear(unpack_context *ctx)
{
-    unsigned int i;
-    for (i = 1; i < ctx->top; i++) {
-        Py_CLEAR(ctx->stack[i].obj);
+    for (unsigned int i = 0; i < ctx->top; i++) {
         /* map_key holds a live reference only while waiting for the value */
         if (ctx->stack[i].ct == CT_MAP_VALUE) {
             Py_CLEAR(ctx->stack[i].map_key);
         }
+        Py_CLEAR(ctx->stack[i].obj);
     }
-    Py_CLEAR(ctx->stack[0].obj);
+    unpack_init(ctx);
}

Source: GitHub Commit 2c56ddb. The fix clears every stack slot from index 0 and calls unpack_init(ctx) to fully reset the parser state before the Unpacker is reused.

Detection Methods for CVE-2026-57585

Indicators of Compromise

Unexpected Python process terminations with SIGSEGV signals in services that ingest MessagePack data
Repeated exception traces referencing msgpack._unpacker or Unpacker.feed immediately preceding a crash
Elevated rates of malformed MessagePack payloads from a single client or upstream connection

Detection Strategies

Inventory Python environments and identify installations of msgpack below version 1.2.1 using pip list or SBOM tooling
Monitor application and container logs for Segmentation fault events correlated with msgpack decode errors
Instrument network-facing services with crash reporting (e.g., core dumps, systemd-coredump) to capture the faulting stack

Monitoring Recommendations

Alert on abnormal restart counts for RPC, queue, or API workers that decode MessagePack traffic
Track ingress payload validation errors and correlate spikes with worker crashes
Log the installed msgpack version at service startup to detect drift from patched baselines

How to Mitigate CVE-2026-57585

Immediate Actions Required

Upgrade msgpack-python to version 1.2.1 or later across all Python environments
Rebuild and redeploy container images and virtual environments that pin a vulnerable msgpack release
Audit application code for Unpacker instances that are reused after exceptions and refactor to instantiate a fresh Unpacker per stream

Patch Information

The fix is committed in msgpack-python commit 2c56ddb and released in version 1.2.1. Details are published in the GitHub Security Advisory GHSA-6v7p-g79w-8964.

Workarounds

Discard and recreate the Unpacker instance whenever a decoding exception is caught, rather than continuing to feed data into it
Validate or size-limit MessagePack payloads at the network boundary to reduce exposure to malformed inputs
Isolate MessagePack decoding in worker processes with automatic restart to contain the impact of a crash

bash

# Upgrade msgpack to the patched release
python -m pip install --upgrade 'msgpack>=1.2.1'

# Verify the installed version
python -c "import msgpack; print(msgpack.version)"