MessagePack for Golang subject to DoS via Unmarshal panic

ÉLEVÉE 7.5CVE-2022-41719 · GHSA-jr77-8gx4-h5qh · GO-2022-0972 · Published 10/11/2022 · updated 17/06/2026

En bref

CVE-2022-41719 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant github.com/shamaton/msgpack/v2, messagepack (messagepack project).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.4%, plus élevée que 71.8% des vulnérabilités.
Correctif : mettre à jour vers 2.1.1 ou plus récent.

Package	Affected versions	Patched versions
github.com/shamaton/msgpack/v2 Go	`< 2.1.1`	`2.1.1`
messagepack messagepack_project	`< 2.1.1`	`2.1.1`

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.

NVD description

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.