data/reports: review GO-2026-4513, update GO-2026-4740 - data/reports/GO-2026-4513.yaml - data/reports/GO-2026-4740.yaml Updates golang/vulndb#4513 Updates golang/vulndb#4740 Fixes golang/vulndb#5034 Change-Id: Id2f8d147fd7b3f51c9b2e99a78b54d1a7aecbabb Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/843085 Auto-Submit: Ian Alexander <jitsu@google.com> Reviewed-by: Nicholas Husin <husin@google.com> LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Reviewed-by: Nicholas Husin <nsh@golang.org>
diff --git a/data/cve/v5/GO-2026-4513.json b/data/cve/v5/GO-2026-4513.json index 3c45dad..ecbb121 100644 --- a/data/cve/v5/GO-2026-4513.json +++ b/data/cve/v5/GO-2026-4513.json
@@ -46,6 +46,14 @@ "product": "github.com/shamaton/msgpack/v2", "collectionURL": "https://pkg.go.dev", "packageName": "github.com/shamaton/msgpack/v2", + "versions": [ + { + "version": "0", + "lessThan": "2.4.1", + "status": "affected", + "versionType": "semver" + } + ], "programRoutines": [ { "name": "Unmarshal" @@ -57,13 +65,21 @@ "name": "UnmarshalAsArray" } ], - "defaultStatus": "affected" + "defaultStatus": "unaffected" }, { "vendor": "github.com/shamaton/msgpack/v3", "product": "github.com/shamaton/msgpack/v3", "collectionURL": "https://pkg.go.dev", "packageName": "github.com/shamaton/msgpack/v3", + "versions": [ + { + "version": "0", + "lessThan": "3.1.1", + "status": "affected", + "versionType": "semver" + } + ], "programRoutines": [ { "name": "Unmarshal" @@ -75,7 +91,7 @@ "name": "UnmarshalAsArray" } ], - "defaultStatus": "affected" + "defaultStatus": "unaffected" } ], "problemTypes": [
diff --git a/data/osv/GO-2026-4513.json b/data/osv/GO-2026-4513.json index 32e6f9f..40ccf13 100644 --- a/data/osv/GO-2026-4513.json +++ b/data/osv/GO-2026-4513.json
@@ -4,7 +4,9 @@ "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", "aliases": [ - "CVE-2026-32284" + "CVE-2026-32284", + "CVE-2026-32284", + "GHSA-h9q6-hc68-35rp" ], "summary": "Denial of service in github.com/shamaton/msgpack", "details": "The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.", @@ -50,6 +52,9 @@ "events": [ { "introduced": "0" + }, + { + "fixed": "2.4.1" } ] } @@ -78,6 +83,9 @@ "events": [ { "introduced": "0" + }, + { + "fixed": "3.1.1" } ] }
diff --git a/data/osv/GO-2026-4740.json b/data/osv/GO-2026-4740.json index 84f259c..9b8beac 100644 --- a/data/osv/GO-2026-4740.json +++ b/data/osv/GO-2026-4740.json
@@ -3,11 +3,12 @@ "id": "GO-2026-4740", "modified": "0001-01-01T00:00:00Z", "published": "0001-01-01T00:00:00Z", - "aliases": [ - "GHSA-h9q6-hc68-35rp" + "withdrawn": "2026-10-01T16:21:21Z", + "related": [ + "CVE-2026-32284" ], - "summary": "Denial of service in github.com/shamaton/msgpack", - "details": "Denial of service in github.com/shamaton/msgpack", + "summary": "WITHDRAWN: Denial of service in github.com/shamaton/msgpack", + "details": "(This report has been withdrawn with reason: \"Duplicate of 4513\").", "affected": [ { "package": { @@ -63,15 +64,15 @@ ], "references": [ { - "type": "ADVISORY", - "url": "https://github.com/advisories/GHSA-h9q6-hc68-35rp" - }, - { "type": "REPORT", "url": "https://github.com/shamaton/msgpack/issues/59" }, { "type": "WEB", + "url": "https://github.com/advisories/GHSA-h9q6-hc68-35rp" + }, + { + "type": "WEB", "url": "https://github.com/golang/vulndb/issues/4513" }, { @@ -81,6 +82,6 @@ ], "database_specific": { "url": "https://pkg.go.dev/vuln/GO-2026-4740", - "review_status": "UNREVIEWED" + "review_status": "REVIEWED" } } \ No newline at end of file
diff --git a/data/reports/GO-2026-4513.yaml b/data/reports/GO-2026-4513.yaml index db96d18..4de12e0 100644 --- a/data/reports/GO-2026-4513.yaml +++ b/data/reports/GO-2026-4513.yaml
@@ -12,6 +12,8 @@ - DecodeStructAsArray - DecodeStructAsMap - module: github.com/shamaton/msgpack/v2 + versions: + - fixed: 2.4.1 vulnerable_at: 2.4.0 packages: - package: github.com/shamaton/msgpack/v2 @@ -20,6 +22,8 @@ - UnmarshalAsMap - UnmarshalAsArray - module: github.com/shamaton/msgpack/v3 + versions: + - fixed: 3.1.1 vulnerable_at: 3.1.0 packages: - package: github.com/shamaton/msgpack/v3 @@ -33,6 +37,10 @@ processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack. +cves: + - CVE-2026-32284 +ghsas: + - GHSA-h9q6-hc68-35rp references: - report: https://github.com/shamaton/msgpack/issues/59 - report: https://github.com/golang/vulndb/issues/4513
diff --git a/data/reports/GO-2026-4740.yaml b/data/reports/GO-2026-4740.yaml index ef945fd..fd87528 100644 --- a/data/reports/GO-2026-4740.yaml +++ b/data/reports/GO-2026-4740.yaml
@@ -3,22 +3,20 @@ - module: github.com/shamaton/msgpack vulnerable_at: 1.2.1 - module: github.com/shamaton/msgpack/v2 - unsupported_versions: - - last_affected: 2.4.0 vulnerable_at: 2.4.0 - module: github.com/shamaton/msgpack/v3 - unsupported_versions: - - last_affected: 3.1.0 vulnerable_at: 3.1.0 -summary: Denial of service in github.com/shamaton/msgpack -ghsas: - - GHSA-h9q6-hc68-35rp +summary: 'WITHDRAWN: Denial of service in github.com/shamaton/msgpack' +description: '(This report has been withdrawn with reason: "Duplicate of 4513").' +withdrawn: "2026-10-01T16:21:21Z" +related: + - CVE-2026-32284 references: - - advisory: https://github.com/advisories/GHSA-h9q6-hc68-35rp - report: https://github.com/shamaton/msgpack/issues/59 + - web: https://github.com/advisories/GHSA-h9q6-hc68-35rp - web: https://github.com/golang/vulndb/issues/4513 - web: https://securityinfinity.com/research/shamaton-msgpack-oob-panic-fixext-dos-2026 source: - id: GHSA-h9q6-hc68-35rp + id: go-security-team created: 2026-03-23T13:02:26.718935367-04:00 -review_status: UNREVIEWED +review_status: REVIEWED