The msgpack-python C extension has a memory leak vulnerability when deserialization rejects a map key with strict_map_key validation enabled (default). This leak occurs because the decoded map value is not released on key validation failure, causing unbounded memory growth and potential denial of service. Additionally, the streaming Unpacker API may suffer from use-after-free issues due to stale parser-stack references. The issue affects msgpack versions prior to 1.2.3 and has been fixed in 1.2.3.