| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/shamaton/msgpack | all versions | |
| github.com/shamaton/msgpack/v2 | ≤ 2.4.0< 2.4.1all versions | 2.4.1 |
| github.com/shamaton/msgpack/v3 | ≤ 3.1.0< 3.1.1all versions | 3.1.1 |
| msgpack | ≤ 3.1.2 |
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free