GoSeverity: HighStatus: Published

msgpack: unbounded MessagePack nesting causes a fatal goroutine stack overflow (DoS)

The decoder had no limit on how deeply MessagePack arrays and maps could be nested. A small crafted input with deep nesting made decoding recurse until the goroutine stack overflowed, which is a fatal runtime error that cannot be recovered and stops the whole process. Fixed in v3 3.2.4 and v2 2.4.3.