CVE-2026-32284

EUVD-2026-16343
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 32%
Affected Products (NVD)
VendorProductVersion
shamatonmsgpack
𝑥
≤ 3.1.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/golang/vulndb/issues/4513
https://github.com/shamaton/msgpack/issues/59
https://pkg.go.dev/vuln/GO-2026-4513
https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026