Register | Log in

python-msgpack

Python 3 implementation of MessagePack format

Choose email to subscribe with

general

source: python-msgpack (main)
version: 1.2.1-1
maintainer: Debian OpenStack (DMD)
uploaders: Robert S. Edmonds [DMD] – Thomas Goirand [DMD]
arch: any
std-ver: 4.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.0.0-6
oldstable: 1.0.3-2
stable: 1.0.3-3
testing: 1.2.1-1
unstable: 1.2.1-1

versioned links

1.0.0-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.3-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.0.3-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

python3-msgpack

action needed

Problems while searching for a new upstream version high

uscan had problems while searching for a new upstream version:

In watchfile debian/watch, reading webpage
  https://github.com/msgpack/msgpack-python/tags failed: 500 Header line too long (limit is 8192)

Created: 2026-10-24 Last update: 2026-10-24 07:00

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2026-57585: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
CVE-2026-114613: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

Created: 2026-07-02 Last update: 2026-10-24 01:32

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-114613: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

Created: 2026-10-23 Last update: 2026-10-24 01:32

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-114613: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

Created: 2026-10-23 Last update: 2026-10-24 01:32

2 security issues in bookworm high

There are 2 open security issues in bookworm.

2 important issues:

CVE-2026-57585: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.
CVE-2026-114613: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

Created: 2026-07-02 Last update: 2026-10-24 01:32

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-57585: MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.1, there is an Out-of-bounds read/crash on Unpacker reuse after a caught error, potentially leading to a DoS attack. If the Unpacker is used repeatedly after an error occurs, the process may crash with a SEGV. This issue has been fixed in version 1.2.1.

Created: 2026-07-02 Last update: 2026-08-02 20:32

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-01-27 Last update: 2026-09-20 05:30

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.4.1).

Created: 2020-01-21 Last update: 2026-09-20 00:01

news

[2026-09-24] python-msgpack 1.2.1-1 MIGRATED to testing (Debian testing watch)
[2026-09-19] Accepted python-msgpack 1.2.1-1 (source) into unstable (Thomas Goirand)
[2026-07-10] python-msgpack 1.1.2-4 MIGRATED to testing (Debian testing watch)
[2026-07-07] Accepted python-msgpack 1.1.2-4 (source) into unstable (Thomas Goirand)
[2026-07-07] python-msgpack 1.1.2-3 MIGRATED to testing (Debian testing watch)
[2026-07-05] Accepted python-msgpack 1.1.2-3 (source) into unstable (Thomas Goirand)
[2026-02-20] python-msgpack 1.1.2-2 MIGRATED to testing (Debian testing watch)
[2026-02-09] Accepted python-msgpack 1.1.2-2 (source) into unstable (Thomas Goirand)
[2025-12-14] python-msgpack 1.1.2-1 MIGRATED to testing (Debian testing watch)
[2025-12-07] Accepted python-msgpack 1.1.2-1 (source) into unstable (Thomas Goirand)
[2023-08-18] python-msgpack 1.0.3-3 MIGRATED to testing (Debian testing watch)
[2023-08-15] Accepted python-msgpack 1.0.3-3 (source) into unstable (Thomas Goirand)
[2022-11-23] python-msgpack 1.0.3-2 MIGRATED to testing (Debian testing watch)
[2022-11-20] Accepted python-msgpack 1.0.3-2 (source) into unstable (Thomas Goirand)
[2022-02-22] python-msgpack 1.0.3-1 MIGRATED to testing (Debian testing watch)
[2022-02-17] Accepted python-msgpack 1.0.3-1 (source) into unstable (Thomas Goirand)
[2021-08-26] python-msgpack 1.0.2-2 MIGRATED to testing (Debian testing watch)
[2021-08-16] Accepted python-msgpack 1.0.2-2 (source) into unstable (Thomas Goirand)
[2021-03-08] Accepted python-msgpack 1.0.2-1 (source) into experimental (Thomas Goirand)
[2020-11-26] python-msgpack 1.0.0-6 MIGRATED to testing (Debian testing watch)
[2020-11-24] Accepted python-msgpack 1.0.0-6 (source) into unstable (Thomas Goirand)
[2020-11-20] Accepted python-msgpack 1.0.0-5 (source) into unstable (Thomas Goirand)
[2020-10-14] Accepted python-msgpack 1.0.0-4 (source) into unstable (Thomas Goirand)
[2020-10-14] Accepted python-msgpack 1.0.0-3 (source) into unstable (Thomas Goirand)
[2020-10-14] Accepted python-msgpack 1.0.0-2 (source) into unstable (Thomas Goirand)
[2020-09-24] Accepted python-msgpack 1.0.0-1 (source) into experimental (Thomas Goirand)
[2020-03-26] python-msgpack 0.6.2-1 MIGRATED to testing (Debian testing watch)
[2020-03-14] Accepted python-msgpack 0.6.2-1 (source) into unstable (Thomas Goirand)
[2020-02-16] python-msgpack 0.5.6-3 MIGRATED to testing (Debian testing watch)
[2020-01-21] Accepted python-msgpack 0.5.6-3 (source) into unstable (Thomas Goirand)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.1.2-4

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing