CVE-2026-107299: msgpack5: Reserved byte can cause unbounded stream buffering

October 8, 2026

The reserved MessagePack byte 0xc1 is incorrectly treated as incomplete input. When it appears at the start of a decoder stream, all subsequent data is retained while the decoder waits for bytes that can never make the value valid, allowing memory exhaustion.

References

github.com/advisories/GHSA-26wq-p25c-j6fv
github.com/mcollina/msgpack5/commit/85da345bf1acc18ca441741e5cf4aa0ed0d69314
github.com/mcollina/msgpack5/releases/tag/v6.1.0
github.com/mcollina/msgpack5/security/advisories/GHSA-26wq-p25c-j6fv
nvd.nist.gov/vuln/detail/CVE-2026-107299

Code Behaviors & Features

Detect and mitigate CVE-2026-107299 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →