metadata
tags:
- security
- proof-of-concept
- messagepack
- denial-of-service
MessagePack nested-array StackError PoC
This repository hosts a benign security research PoC for a MessagePack parser denial of service.
Files
messagepack-nested-5000.msgpack
Reproduction
Use latest msgpack 1.2.1:
python3 -m venv .venv-msgpack-121
. .venv-msgpack-121/bin/activate
pip install msgpack==1.2.1
python - <<'PY'
import msgpack
data = open("messagepack-nested-5000.msgpack", "rb").read()
msgpack.unpackb(data, raw=False)
PY
Observed result:
StackError
Safety note
This artifact is a non-executable malformed model-file PoC for parser-stress testing only.