{"id":"CVE-2026-32284","revision":"82e0e337b1ff4d05838f9c7bda217c48","records":[{"revision":"82e0e337b1ff4d05838f9c7bda217c48","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-32284","aliases":[],"title":"Denial of service in github.com/shamaton/msgpack","description":"The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.","state":0,"publishedAt":"2026-03-26T19:40:51.686+00:00","modifiedAt":"2026-10-07T17:46:21.91+00:00","affected":[{"ecosystem":"https://pkg.go.dev","name":"github.com/shamaton/msgpack","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"github.com/shamaton/msgpack\",\n                    \"product\": \"github.com/shamaton/msgpack\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"github.com/shamaton/msgpack\",\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Unmarshal\"\n                        },\n                        {\n                            \"name\": \"UnmarshalAsMap\"\n                        },\n                        {\n                            \"name\": \"UnmarshalAsArray\"\n                        },\n                        {\n                            \"name\": \"DecodeStructAsArray\"\n                        },\n                        {\n                            \"name\": \"DecodeStructAsMap\"\n                        }\n                    ],\n                    \"defaultStatus\": \"affected\"\n                }"},{"ecosystem":"https://pkg.go.dev","name":"github.com/shamaton/msgpack/v2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"github.com/shamaton/msgpack/v2\",\n                    \"product\": \"github.com/shamaton/msgpack/v2\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"github.com/shamaton/msgpack/v2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.4.1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Unmarshal\"\n                        },\n                        {\n                            \"name\": \"UnmarshalAsMap\"\n                        },\n                        {\n                            \"name\": \"UnmarshalAsArray\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"},{"ecosystem":"https://pkg.go.dev","name":"github.com/shamaton/msgpack/v3","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"github.com/shamaton/msgpack/v3\",\n                    \"product\": \"github.com/shamaton/msgpack/v3\",\n                    \"collectionURL\": \"https://pkg.go.dev\",\n                    \"packageName\": \"github.com/shamaton/msgpack/v3\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.1.1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"Unmarshal\"\n                        },\n                        {\n                            \"name\": \"UnmarshalAsMap\"\n                        },\n                        {\n                            \"name\": \"UnmarshalAsArray\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://github.com/shamaton/msgpack/issues/59","https://github.com/golang/vulndb/issues/4513","https://pkg.go.dev/vuln/GO-2026-4513"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-32284","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-32284","identifiers":["CVE-2026-32284"]},"retained":false,"historicalAffected":[]}],"coverage":[]}