CVE-2026-57585

A flaw was found in MessagePack for Python, a serializer implementation. This vulnerability, categorized as a Use-After-Free (CWE-416), occurs when the Unpacker component is reused after an error. A remote attacker could exploit this by repeatedly providing untrusted input, leading to an out-of-bounds read and a system crash. This can result in a Denial of Service (DoS) attack.

This Important flaw in MessagePack for Python can lead to a denial of service. An out-of-bounds read and subsequent process crash may occur if an Unpacker instance is reused after an error has been caught, potentially allowing an attacker to disrupt services that process MessagePack data.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, applications utilizing MessagePack for Python should be reviewed to ensure that Unpacker instances are not reused after an error has occurred during unpacking. Instead, a new Unpacker instance should be created for subsequent operations.