CVE-2026-32284

Description

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.

PUBLISHED Reserved 2026-03-11 | Published 2026-03-26 | Updated 2026-03-30 | Assigner Go

Problem types

CWE-125: Out-of-bounds Read

Product status

References

securityinfinity.com/...on-msgpack-oob-panic-fixext-dos-2026 exploit

github.com/shamaton/msgpack/issues/59

github.com/golang/vulndb/issues/4513

pkg.go.dev/vuln/GO-2026-4513

cve.org (CVE-2026-32284)

nvd.nist.gov (CVE-2026-32284)

Download JSON