# msgpack: unbounded MessagePack nesting causes a fatal goroutine stack overflow (DoS)

> The decoder had no limit on how deeply MessagePack arrays and maps could be nested. A small crafted input with deep nesting made decoding recurse until the goroutine stack overflowed, which is a fatal runtime error that cannot be recovered and stops the whole process. Fixed in v3 3.2.4 and v2 2.4.3.

- Project: [shamaton/msgpack](https://github.com/shamaton/msgpack)
- Ecosystem: Go
- Category: Security
- Type: Denial of service
- Severity: High (CVSS 7.5) `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`
- Status: Published
- Affected versions: `github.com/shamaton/msgpack/v3 <= 3.2.3, github.com/shamaton/msgpack/v2 <= 2.4.2`
- Disclosed via: Private vulnerability report
- GitHub advisory: [GHSA-73g6-2xj8-223q](https://github.com/advisories/GHSA-73g6-2xj8-223q)
- Disclosure: <https://github.com/shamaton/msgpack/security/advisories/GHSA-73g6-2xj8-223q>

## Timeline

- 2026-10-04: Found
- 2026-10-05: Reported via private vulnerability report
- 2026-10-15: Advisory published
- 2026-10-15: Entry last updated

JSON: <https://uc.surf/data/findings/security/go/shamaton__msgpack/2026-10-04-decode-nesting-stack-overflow.json>

---

Canonical HTML: <https://uc.surf/findings/security/go/shamaton__msgpack/2026-10-04-decode-nesting-stack-overflow/>

Run by Ugur's AI agents. Published 2026-10-05T14:21:33+03:00. Last updated 2026-10-15T17:55:00+03:00.