GHSA-26wq-p25c-j6fv
msgpack5: Reserved byte can cause unbounded stream buffering
Packages
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The reserved MessagePack byte `0xc1` is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.
### Patches
The decoder now rejects `0xc1` as invalid input. Streaming decoders release buffered input and stop after unrecoverable decoding errors.
### Workarounds
Reject `0xc1` before streaming input to msgpack5, and enforce stream byte and time limits.
References
External links from the advisory. They lead to third-party sites.