cve.nowby Sazabi

GoPackage

github.com/shamaton/msgpack/v2

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: v2.4.5 (Nov 8, 2026): no advisory affects it
Newest unaffected release: v2.4.5 (Nov 8, 2026), the latest release
Advisories: 2 · 2 high

Releases: 17 since v2.0.0 (Feb 15, 2021)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-32284
Affects v2.0.0 to v2.4.0 (v2.4.1 is outside it)
CVE-2022-41719
Affects v2.0.0 to v2.1.0 (v2.1.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

CVE-2026-32284High 7.5
Denial of service in github.com/shamaton/msgpack
Affected: through 2.4.0; fixed in 2.4.1.
Fixed in v2.4.1 (released May 14, 2026, 49 days after disclosure).
The latest release, v2.4.5, is not affected.
CVE-2022-41719High 7.5
Panic in github.com/shamaton/msgpack/v2
Affected: fixed in 2.1.1; fixed in 2.1.1.
Fixed in v2.1.1 (released Oct 21, 2022, 20 days before disclosure).
The latest release, v2.4.5, is not affected.