Description
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
github.com/shamaton/msgpack github.com/shamaton/msgpack
Default version status: affected
github.com/shamaton/msgpack/v2 github.com/shamaton/msgpack/v2
Default version status: unaffected
0 to < 2.4.1affected
github.com/shamaton/msgpack/v3 github.com/shamaton/msgpack/v3
Default version status: unaffected
0 to < 3.1.1affected