The vulnerability is a memory leak in the msgpack-python C extension that occurs when deserialization rejects a key with strict_map_key=True. The leak persists until the process exits, allowing attacker-controlled MessagePack data to cause unbounded growth of the process’s memory footprint and eventually trigger a denial of service. This flaw is a classic unbounded memory allocation vulnerability governed by CWE-401.

All installations of the msgpack-python library prior to version 1.2.3 are affected. The bug afflicts both the unpackb() function and the streaming Unpacker API; the pure‑Python fallback path does not exhibit the leak in the supplied tests. The environment is the Python runtime, and affected systems are those running the vulnerable library within any Python application that processes MessagePack payloads.

The CVSS score of 7.5 marks a high severity. Because the EPSS score is unavailable and the vulnerability is not currently listed in CISA’s KEV catalog, the existing exploitation probability is unclear, but the impact remains significant. Attack occurs by transmitting malformed MessagePack data that triggers a strict_map_key validation failure; the body of the attack can be supplied over any interface that accepts external MessagePack input, so remote exploitation is plausible in exposed services.