Skip to content

fix(parser/msgpack): bound the packet decoder recursion depth to prevent stack-overflow - #772

Merged
Totodore merged 2 commits into
mainfrom
fix-cve-msgpack-recursion
Aug 7, 2026
Merged

fix(parser/msgpack): bound the packet decoder recursion depth to prevent stack-overflow#772
Totodore merged 2 commits into
mainfrom
fix-cve-msgpack-recursion

Conversation

@Totodore

@Totodore Totodore commented Aug 7, 2026

Copy link
Copy Markdown
Owner

Motivation

Fix vulnerability found by @afldl: GHSA-c6g7-r2mf-pf5g

Solution

Add a recursion depth param on the recursive function call.

@Totodore Totodore added C-Bug Something isn't working A-parser-msgpack Area related to parser msgpack labels Aug 7, 2026
@codspeed-hq

codspeed-hq Bot commented Aug 7, 2026

Copy link
Copy Markdown

Merging this PR will not alter performance

✅ 87 untouched benchmarks


Comparing fix-cve-msgpack-recursion (2271c8b) with main (4e3a628)

Open in CodSpeed

@Totodore
Totodore merged commit 9d40b67 into main Aug 7, 2026
27 checks passed
@Totodore
Totodore deleted the fix-cve-msgpack-recursion branch August 7, 2026 07:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

A-parser-msgpack Area related to parser msgpack C-Bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant