high7.5
CVE-2022-41719
MessagePack for Golang subject to DoS via Unmarshal panic
Impact
Unmarshal can panic on some inputs, possibly allowing for denial of service attacks. This issue has been patched in version 2.1.1.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/shamaton/msgpack/v2 | < 2.1.1 | 2.1.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Messagepack Project | Messagepack | before 2.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/shamaton/msgpack/issues/31
- https://github.com/shamaton/msgpack/pull/32
- https://pkg.go.dev/vuln/GO-2022-0972
- https://github.com/advisories/GHSA-jr77-8gx4-h5qh
- https://nvd.nist.gov/vuln/detail/CVE-2022-41719
- https://github.com/shamaton/msgpack/releases/tag/v2.1.1