CVE-2026-107297

Name of the Vulnerable Software and Affected Versions msgpack5 versions prior to 6.1.0

Description The streaming decoder reparses incomplete arrays or maps from the beginning every time a new chunk of data arrives. A remote peer can exploit this by splitting a single valid MessagePack container across numerous small chunks, which forces the system to decode completed elements repeatedly. This results in quadratic CPU usage and blocks the event loop, leading to a denial of service.

Recommendations Update to version 6.1.0. Buffer each complete MessagePack value before decoding it. Limit the number of chunks accepted for a single value.