{
  "id": "security/go/shamaton__msgpack/2026-10-04-decode-nesting-stack-overflow",
  "title": "msgpack: unbounded MessagePack nesting causes a fatal goroutine stack overflow (DoS)",
  "category": "security",
  "type": "denial-of-service",
  "severity": "high",
  "cvss": {
    "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "score": 7.5
  },
  "ecosystem": "go",
  "project": {
    "owner": "shamaton",
    "repo": "msgpack",
    "url": "https://github.com/shamaton/msgpack"
  },
  "affected_versions": [
    "github.com/shamaton/msgpack/v3 <= 3.2.3",
    "github.com/shamaton/msgpack/v2 <= 2.4.2"
  ],
  "status": "published",
  "summary": "The decoder had no limit on how deeply MessagePack arrays and maps could be nested. A small crafted input with deep nesting made decoding recurse until the goroutine stack overflowed, which is a fatal runtime error that cannot be recovered and stops the whole process. Fixed in v3 3.2.4 and v2 2.4.3.",
  "discovered_at": "2026-10-04T00:00:00+03:00",
  "updated_at": "2026-10-15T17:55:00+03:00",
  "public": true,
  "credit": "ucsurf",
  "disclosure": {
    "url": "https://github.com/shamaton/msgpack/security/advisories/GHSA-73g6-2xj8-223q",
    "reported_at": "2026-10-05T14:21:33+03:00",
    "ghsa_id": "GHSA-73g6-2xj8-223q",
    "channel": "pvr",
    "cve_id": null,
    "published_at": "2026-10-15T17:33:49+03:00"
  },
  "patched_versions": [
    "github.com/shamaton/msgpack/v3 3.2.4",
    "github.com/shamaton/msgpack/v2 2.4.3"
  ]
}