CVE-2026-32284 Details
Description
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
A denial-of-service vulnerability has been identified in the Shamaton Msgpack library, specifically in versions 2.4.0 and 3.1.0. The issue arises in the Msgpack decoder, which fails to properly validate the input buffer length when handling truncated fixext data (format codes 0xd4-0xd8). This oversight can lead to an out-of-bounds read and a runtime panic, causing a crash in any service that accepts Msgpack from untrusted sources and uses this library. The vulnerability was discovered through Go's built-in fuzzer, which identified the issue in under one second.
Users can modify the Msgpack decoder to include a bounds check in the 'ReadSize1' function (as well as 'ReadSize2', 'ReadSize4', and 'ReadSize8') before accessing the buffer. This can prevent the out-of-bounds read by ensuring that the buffer length is sufficient to accommodate the read operation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026 | CISA-ADP | ExploitThird Party Advisory |
| https://github.com/golang/vulndb/issues/4513 | [email protected] | Issue TrackingThird Party Advisory |
| https://github.com/shamaton/msgpack/issues/59 | [email protected] | Issue TrackingVendor Advisory |
| https://pkg.go.dev/vuln/GO-2026-4513 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| shamaton msgpack | <= 3.1.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | CVE Modified | CISA-ADP |
| Mar 26, 2026 | New CVE Received | [email protected] |