MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error…

A vulnerability exists in the Python MessagePack serializer library (msgpack-python) prior to version 1.2.1. The flaw is an out-of-bounds read that occurs when the Unpacker object is reused after a caught error. Repeated use of the Unpacker following an error can cause the process to crash with a segmentation fault (SEGV). This behavior can potentially be exploited to conduct a Denial of Service (DoS) attack. The vulnerability has been assigned CVE-2026-57585. A fix has been released in version 1.2.1 of the library. Users are advised to upgrade to version 1.2.1 or later to mitigate this issue. The fix is available via the official GitHub repository commit and was disclosed through GitHub Security Advisories.