Hi,

The following vulnerability was published for python-msgpack.

CVE-2026-114613[0]:
| MessagePack is the serializer implementation for Python msgpack.org.
| Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack)
| leaks a decoded map value when deserialization rejects a key with
| strict_map_key=True (the default). Repeated malformed inputs can
| cause unbounded process memory growth and denial of service in
| applications that deserialize attacker-controlled MessagePack data.
| Both unpackb() and the streaming Unpacker API are affected. The
| pure-Python fallback does not exhibit this leak in the reported
| tests. This issue is fixed in version 1.2.3.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-114613
https://www.cve.org/CVERecord?id=CVE-2026-114613
[1] https://github.com/msgpack/msgpack-python/security/advisories/GHSA-j586-36cw-2gc2
[2] https://github.com/msgpack/msgpack-python/commit/620b0eb4c89cd72d4098564537624d9dbb2ce141

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore