Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
msgpack/msgpack-python
main @ 2de6273
3
Fixes
0
CVEs
MEDIUM
Peak severity
33.3%
Coverage
Highlights
Denial of Service: 1 prior fix. Scrutinize any change in this area.
msgpack/_unpacker.pyx: most-fixed (2 issues). Treat as high-risk during review.
0 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Memory Corruption: Re-entering the Unpacker __init__ method without properly clearing the previous parser context can lead to unreleased buffers and memory management bugs. Developers must ensure that previous state and associated memory structures are fully released before initialization completes.
Denial of Service: Failure to clear partially unpacked objects from the internal parsing stack when decoding fails on nested elements leads to memory leaks. This allows attackers to exhaust system memory by sending repeatedly invalid, deeply nested structures.
Integer Overflow: When unpacking large timestamp values, unchecked conversions into Python datetime offsets can cause integer overflows, particularly on 32-bit platforms. Sanitizing values through range-reduction and normalization is required prior to calling native API functions.