CVE-2026-114613

A flaw was found in msgpack. A remote attacker could trigger a memory leak by sending specially crafted MessagePack data containing rejected map keys during deserialization. Repeated transmission of such malformed inputs can lead to excessive process memory consumption, resulting in a Denial of Service (DoS) for the affected application.

Red Hat has evaluated this vulnerability as having an Important severity because an unauthenticated remote attacker can cause a denial of service by triggering excessive memory allocation in exposed network services. Python MessagePack components deployed across Red Hat products use the compiled C accelerator by default when parsing incoming serialized data. When malformed payloads are processed, unreleased objects accumulate in memory over time, eventually leading to process crashes and service unavailability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.