Threats affecting pkg:brew/datalad

The msgpack-python C extension has a memory leak vulnerability when deserializing MessagePack data with strict_map_key validation enabled (default). If a map key is invalid, the decoded map value is leaked, causing unbounded memory growth and potential denial of service. This affects both unpackb() and the streaming Unpacker API. Additionally, the streaming Unpacker may suffer from a use-after-free or double decrement issue due to stale parser-stack references. The issue is confirmed in msgpack version 1.2.2 and fixed in 1.6.5.

MessagePack for Python contains a vulnerability where reusing an Unpacker instance after an error can cause a process crash (segmentation fault). This can lead to denial-of-service (DoS) conditions when unpacking untrusted input repeatedly. The issue is fixed in version 1.6.0_1. Users are advised to create a new Unpacker after an error instead of reusing the same one, as the patch prevents crashes but does not ensure correct data processing after errors.