7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-h9q6-hc68-35rp

GHSA-h9q6-hc68-35rp: Denial of service in github.com/shamaton/msgpack

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-h9q6-hc68-35rp

GHSA-h9q6-hc68-35rp:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/shamaton/msgpack/v2	go	<= 2.4.0
github.com/shamaton/msgpack/v3	go	<= 3.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the msgpack decoder's handling of fixext data. Specifically, the ReadSize1 function in ext/decode.go reads from the input buffer without verifying its length. When a fixext format code (0xd4-0xd8) is received without the subsequent data, this function attempts to read beyond the buffer's bounds, triggering a panic and causing a denial of service. The issue report provides a detailed analysis and a panic trace, which clearly identifies (*DecoderCommon).ReadSize1 as the root cause of the vulnerability. The (*timeDecoder).IsType function is also identified as it is the function that calls the vulnerable ReadSize1 function when decoding time values. The vulnerability affects both v2 and v3 of the library, and since no patch is available, the analysis is based on the detailed information from the GitHub issue.

Vulnerable functions

github.com/shamaton/msgpack/v2/internal/ext.(*DecoderCommon).ReadSize1

v2/internal/ext/decode.go

This function reads 1 byte from the input buffer to determine the size of the extension data. However, it does not validate if the buffer has enough data to read from, leading to an out-of-bounds read when a truncated fixext message is received. This causes a panic and a denial of service.

github.com/shamaton/msgpack/v3/internal/ext.(*DecoderCommon).ReadSize1

v3/internal/ext/decode.go

github.com/shamaton/msgpack/v2/internal/decoding/time.(*timeDecoder).IsType

v2/internal/decoding/time/decode.go

This function is part of the time decoder and calls the vulnerable `ReadSize1` function. It would appear in the stack trace during an exploit, as it's part of the call chain that processes the malicious input.

github.com/shamaton/msgpack/v3/internal/decoding/time.(*timeDecoder).IsType

v3/internal/decoding/time/decode.go

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.