VULNERABILITY INTELLIGENCE

CVE-2026-32284

CVSS score7.5 HIGH

EPSS probability0.42%

CISA KEVNot currently listed

Published2026-03-26

Last modified2026-10-07

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Description

The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.

Weakness classification

nvd@nist.gov: CWE-125

Primary references

security@golang.org — Issue Tracking, Third Party Advisory
security@golang.org — Issue Tracking, Vendor Advisory
security@golang.org — Third Party Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — Exploit, Third Party Advisory