CVE-2022-41719: MessagePack for Golang subject to DoS via Unmarshal panic

November 11, 2022 (updated November 16, 2022)

Unmarshal can panic on some inputs, possibly allowing for denial of service attacks.

References

github.com/advisories/GHSA-jr77-8gx4-h5qh
github.com/shamaton/msgpack/issues/31
github.com/shamaton/msgpack/pull/32
github.com/shamaton/msgpack/releases/tag/v2.1.1
nvd.nist.gov/vuln/detail/CVE-2022-41719
pkg.go.dev/vuln/GO-2022-0972

Detect and mitigate CVE-2022-41719 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →