Threats tagged 'brew-poetry-cve-2026-114613'

The msgpack-python C extension has an unbounded memory leak when deserializing MessagePack data with strict_map_key validation enabled (default). This occurs because a decoded map value is leaked when a key is rejected, causing memory growth and potential denial of service. Additionally, the streaming Unpacker API may suffer from use-after-free crashes due to stale parser-stack references. The issue affects version 1.2.2 and development commits, with a fix available in version 2.5.1_1.