Debian Patches
Status for python-msgpack/1.2.1-3
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| fix-Unpacker-reentrant-feed-guard.patch | add reentrant guard to Unpacker.feed() A re-entrant feed() call from a hook could corrupt the unpacker's internal buffer state; it now raises RuntimeError. Prerequisite for the CVE-2026-114613 fix, whose Unpacker guards build on this state tracking. =================================================================== |
Inada Naoki <songofacandy@gmail.com> | yes | debian upstream | upstream, https://github.com/msgpack/msgpack-python/commit/cf3fd2b0617d50f60d331490f91110721cebaef6.patch | 2026-10-24 |
| fix-unpackb-use-after-free-ExtraData-non-contiguous-input.patch | fix use-after-free in unpackb() ExtraData path for non-contiguous input For non-contiguous input, get_data_from_buffer() releases the original view and makes a temporary contiguous copy; the ExtraData trailing-bytes slice must be copied out before that copy is released. Prerequisite for the CVE-2026-114613 fix, which reworks the same unpackb() success path. =================================================================== |
TW <tw@waldmann-edv.de> | yes | debian upstream | upstream, https://github.com/msgpack/msgpack-python/commit/091ae208005aaa93b644a199a517129d198b5bef.patch | 2026-10-24 |
| CVE-2026-114613-fix-memory-leak-on-strict-map-key-rejection.patch | fix memory leak and use-after-free in the C extension unpacker CVE-2026-114613 / GHSA-j586-36cw-2gc2: unpack_callback_map_item() leaks the already-decoded map value when strict_map_key rejects the key (the default), allowing unbounded memory growth (~4 MiB per malformed parse) and denial of service with attacker-controlled input, for both unpackb() and the streaming Unpacker. The accompanying reference-ownership audit also fixes a stale parser-stack slot which a later skip() could reactivate and decref on failure, corrupting the object's reference count (potential use-after-free). . Backported to 1.2.1: keeps this series' non-templated error handling (except? -1 and the PyErr_Occurred() re-raise) and leaves the 1.2.2-only hardening (timestamp nanoseconds validation, invalid-state messages) out. =================================================================== |
Inada Naoki <songofacandy@gmail.com> | yes | debian upstream | upstream, https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141.patch | 2026-10-24 |
| CVE-2026-114613-add-regression-tests.patch | add regression tests for CVE-2026-114613 tracemalloc-based leak test for the strict_map_key rejection path and a refcount-based regression test for the stale parser-stack slot use-after-free on Unpacker reuse after an error. =================================================================== |
Thomas Goirand <zigo@debian.org> | no | debian | 2026-10-24 | |
| no-cython-critical_section-directive.patch | drop the @cython.critical_section directives The critical_section directive is only understood by Cython >= 3.1 (it guards object-internal state on free-threaded CPython). Trixie ships cython3 3.0.11, which rejects it as an invalid directive, breaking the trixie backport builds. Debian ships no free-threaded CPython build, so the directives are inert for the produced binaries; remove them to keep the package buildable with both Cython 3.0.x and 3.1.x. =================================================================== |
Thomas Goirand <zigo@debian.org> | no | 2026-10-24 |