https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 17:02:30 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-107299 <p>msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.</p> <p>msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder treats the reserved MessagePack byte 0xc1 as incomplete input instead of invalid input. When 0xc1 begins a stream, subsequent data remains buffered while the decoder waits for bytes that cannot make the value valid, allowing a remote peer to exhaust memory. This issue is fixed in version 6.1.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-107299 https://vulnerability.circl.lu/vuln/ghsa-26wq-p25c-j6fv <p><strong>Affected:</strong> npm: msgpack5</p> <p>### Impact</p> <p>The reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.</p> <p>### Patches</p> <p>The decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.</p> <p>### Workarounds</p> <p>Reject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.</p> <p><strong>Affected:</strong> npm: msgpack5</p> <p>### Impact</p> <p>The reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.</p> <p>### Patches</p> <p>The decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.</p> <p>### Workarounds</p> <p>Reject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.</p> https://vulnerability.circl.lu/vuln/ghsa-26wq-p25c-j6fv