-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 24 Oct 2026 16:42:02 +0200 Source: python-msgpack Architecture: source Version: 1.2.1-2 Distribution: unstable Urgency: high Maintainer: Debian OpenStack <team+openstack@tracker.debian.org> Changed-By: Thomas Goirand <zigo@debian.org> Closes: 1151844 Changes: python-msgpack (1.2.1-2) unstable; urgency=high . * CVE-2026-114613: unbounded memory leak in the C extension on strict_map_key validation failure (DoS with attacker-controlled input), plus use-after-free when resuming the streaming Unpacker after an error. Applied upstream patches (Closes: #1151844): - CVE-2026-114613-fix-memory-leak-on-strict-map-key-rejection.patch - fix-Unpacker-reentrant-feed-guard.patch - fix-unpackb-use-after-free-ExtraData-non-contiguous-input.patch - CVE-2026-114613-add-regression-tests.patch Checksums-Sha1: c0e8f681ed6592cf99c9f5cae9462fe418caf31f 2225 python-msgpack_1.2.1-2.dsc 988d79ff97706efa9f74d9bc1de2ffe968bce8e5 11896 python-msgpack_1.2.1-2.debian.tar.xz d1d2d8e63edf55443577694b77897c9e1e140aac 7647 python-msgpack_1.2.1-2_amd64.buildinfo Checksums-Sha256: bb61eeaf17e5073120e6ce492027123ffc889af017d864234262e6bbb1301835 2225 python-msgpack_1.2.1-2.dsc f4dde3eb4909c679e9dccc0b8bb701405244eb91dbfe23d8f0798f4c98fcae8b 11896 python-msgpack_1.2.1-2.debian.tar.xz bf3faedec2867a4123e08a08e35fa467c09a2e142a512ecb11e9d8a0fd7ca431 7647 python-msgpack_1.2.1-2_amd64.buildinfo Files: dc8b50a255a9b6a7715e5e46dfd0f836 2225 python optional python-msgpack_1.2.1-2.dsc 540e0348a32aab21d3f65b6f54350d45 11896 python optional python-msgpack_1.2.1-2.debian.tar.xz 51a2a868b2bc987d9b75a4ead0e7a1fc 7647 python optional python-msgpack_1.2.1-2_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEoLGp81CJVhMOekJc1BatFaxrQ/4FAmrcxmYACgkQ1BatFaxr Q/4I+Q/+PSHPIVFkxo+Oy9YV+l1UhTkrSmnE42aA5kaIM4YHZvSt0w4cCV0s4Si+ utO9OiivRX48hQL7xXu9vWEhjEbs4zSQTB8gxmseB/yF7euSm6jYOk7+VYN3JTgP u+0U5PYkaOMDcPyt4NwrxuERHTe+sMeHcTN7Hjimq8Kj/AsLHmK3jy6ztnwcSRDC PiMEYsUXVX2+zDKPUf9eainX7RalyxED6UOv87t7sPvGzUvTV5N0KiRykSnQqarO jBb3MqkhRo0wOWdSsXqQXi4fjXuh1etofXIXbfTf6GmRk3L+B85o8NZnxRrIU3Oo n4wi9E03VVmIfoFwePqcAc8XDk7jZHywJD9JG85nph06JYlZ8xBwOLKcwIvATP1E 3cL4bnKU9gqWpZH08L+dHW+546zXgVzVBEkhFZFLJ5DbvJn3BaVEsNuqY6/Nw6k9 OZnI6P8jA2X6Ot1nQtSWg6yEzFUuSbeCxyJmYDjaUVoFSj12qFK1dzpEiYm9p6Tp Iycbfzf4q/gZzC/fCqmOPqPiDzPFGtLjOwemDTylgVtKDATGlG4NqyH2ZXnhSyo0 hb+gtigO1CrdlGaYoMNY6OycCx5zOdLK6dqihvJMBzfDG4jeVxEyNplFJSaxsNPR cF42IS0CsQ+m9CQKLUFMtLEFjWP7SgoNXy+fQr0hVW2AQembNUw= =G2tk -----END PGP SIGNATURE-----
