{"id":"EUVD-2026-16343","enisaUuid":"fb5b612c-cbf6-3b9e-a3ba-c2f1509c9970","description":"The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.","datePublished":"Mar 26, 2026, 7:40:51 PM","dateUpdated":"Oct 7, 2026, 5:46:21 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/shamaton/msgpack/issues/59\nhttps://github.com/golang/vulndb/issues/4513\nhttps://pkg.go.dev/vuln/GO-2026-4513\n","aliases":"CVE-2026-32284\n","assigner":"Go","epss":0.42,"enisaIdProduct":[{"id":"11b02d3e-75c6-370b-b8eb-770cad3ec3d6","product":{"name":"github.com/shamaton/msgpack/v2","vendor":{"name":"github.com/shamaton/msgpack/v2"}},"product_version":"0 \u003c2.4.1"},{"id":"fbf9739e-2e67-30e1-86d2-c8f8c514e309","product":{"name":"github.com/shamaton/msgpack/v3","vendor":{"name":"github.com/shamaton/msgpack/v3"}},"product_version":"0 \u003c3.1.1"}],"enisaIdVendor":[{"id":"2da23f34-9db5-3b29-b110-0eb7279eea91","vendor":{"name":"github.com/shamaton/msgpack/v2"}},{"id":"809e25e7-c259-39ec-8cf9-738c1870beb6","vendor":{"name":"github.com/shamaton/msgpack/v3"}}],"enisaIdVulnerability":[{"id":"88de54aa-5668-3785-8639-9eae11d98aab","vulnerability":{"id":"GHSA-h9q6-hc68-35rp","description":"Denial of service in github.com/shamaton/msgpack","datePublished":"Mar 18, 2026, 12:59:54 PM","dateUpdated":"Mar 30, 2026, 1:57:05 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-32284\nhttps://github.com/golang/vulndb/issues/4513\nhttps://github.com/shamaton/msgpack/issues/59\nhttps://github.com/shamaton/msgpack\nhttps://pkg.go.dev/vuln/GO-2026-4513\nhttps://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026\n","enisa_id":"EUVD-2026-16343\n","aliases":"CVE-2026-32284\nGHSA-h9q6-hc68-35rp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:58:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"da1716e6-6afc-38a8-867e-05c0446abc65","vulnerability":{"id":"CVE-2026-32284","description":"The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.","datePublished":"Mar 26, 2026, 7:40:51 PM","dateUpdated":"Oct 7, 2026, 5:46:21 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/shamaton/msgpack/issues/59\nhttps://github.com/golang/vulndb/issues/4513\nhttps://pkg.go.dev/vuln/GO-2026-4513\n","enisa_id":"EUVD-2026-16343\n","assigner":"Go","epss":0.42,"dataProcessed":"Nov 7, 2026, 7:22:17 AM","vulnerabilityProduct":[{"id":"4a38c8fe-2de7-31f0-a8a1-217f5471952c","product":{"name":"github.com/shamaton/msgpack/v3","vendor":{"name":"github.com/shamaton/msgpack/v3"}},"product_version":"0 \u003c3.1.1"},{"id":"67c432a2-1f98-3a66-a08e-7063a9297242","product":{"name":"github.com/shamaton/msgpack/v2","vendor":{"name":"github.com/shamaton/msgpack/v2"}},"product_version":"0 \u003c2.4.1"}],"vulnerabilityVendor":[{"id":"8921429d-9b3d-34d5-8d76-b748c69c1fcd","vendor":{"name":"github.com/shamaton/msgpack/v2"}},{"id":"8ac2a4f9-ba0c-335c-8334-ae07b580a6b2","vendor":{"name":"github.com/shamaton/msgpack/v3"}}]}}],"enisaIdAdvisory":[]}