CVE-2026-32284: 
NixOS vulnerability analysis and mitigation

CVE-2026-32284 is a denial-of-service vulnerability in the shamaton/msgpack Go library caused by an out-of-bounds read in the msgpack decoder when processing truncated fixext data (format codes 0xd4–0xd8). It affects github.com/shamaton/msgpack/v2 up to v2.4.0 and github.com/shamaton/msgpack/v3 up to v3.1.2 (all versions through 3.1.2). The vulnerability was discovered and reported on February 19, 2026, and published to NVD on March 26, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Issue #59, Go VulnDB #4513).

The root cause is an out-of-bounds read (CWE-125) in the ext/time decoder at ext/decode.go:33, where the ReadSize1 function reads buf[1] without first verifying that len(buf) >= 2. When any fixext format byte (0xd4–0xd8) is received without its required body bytes, the decoder attempts to access an index beyond the slice boundary, triggering an immediate Go runtime panic. This flaw affects all four decode APIs: Unmarshal, UnmarshalAsMap, UnmarshalAsArray, and the round-trip Marshal path. The vulnerability was discovered using Go's built-in fuzzer in under one second with a minimal crasher of a single byte 0xd6, and it represents a regression — the prior fix for CVE-2022-41719 (PR #32) did not cover the ext/time decoder code path (GitHub Issue #59, Go VulnDB #4513).

Successful exploitation causes an uncontrolled Go runtime panic, crashing any service that uses this library to decode msgpack data from untrusted sources. The impact is limited to availability (no confidentiality or integrity compromise), but a single malformed byte is sufficient to bring down the affected service. Any application accepting msgpack-encoded input over a network — such as APIs, message queues, or RPC services — is at risk of complete service disruption without any authentication required (GitHub Issue #59).

1. Reconnaissance: Identify services that accept msgpack-encoded input (e.g., APIs, RPC endpoints, message queue consumers) and are built with Go using the github.com/shamaton/msgpack/v2 or v3 library at versions ≤ v2.4.0 or ≤ v3.1.2.
2. Craft malformed payload: Construct a minimal malformed msgpack message consisting of a single fixext format byte without its required body — for example, the single byte 0xd6 (fixext 4 format code), which is sufficient to trigger the panic.
3. Deliver payload: Send the crafted msgpack payload to any endpoint that passes the data to one of the vulnerable decode functions (Unmarshal, UnmarshalAsMap, UnmarshalAsArray).
4. Trigger panic: The ReadSize1 function in ext/decode.go:33 attempts to read buf[1] from a slice of length 1, causing a Go runtime panic: runtime error: index out of range [1] with length 1.
5. Achieve DoS: The unrecovered panic crashes the goroutine (and potentially the entire service process), resulting in service unavailability (GitHub Issue #59, Go VulnDB #4513).

• Logs: Go runtime panic output in application logs containing runtime error: index out of range [1] with length 1 with a stack trace referencing github.com/shamaton/msgpack/v2/internal/ext.(*DecoderCommon).ReadSize1 at ext/decode.go:33 or equivalent v3 paths.
• Logs: Repeated service crashes or restarts logged by process supervisors (e.g., systemd, Kubernetes) correlating with inbound msgpack requests.
• Network: Inbound requests to msgpack-consuming endpoints containing payloads of one or a few bytes (e.g., a single byte 0xd4–0xd8) from external or unexpected sources.
• Process: Unexpected process termination of Go services with exit code indicating panic, particularly following receipt of network data (GitHub Issue #59).

Update github.com/shamaton/msgpack to a version later than 3.1.2 (v2 and v3) once a patched release is available — the patch should add bounds checks in ReadSize1, ReadSize2, ReadSize4, and ReadSize8 before accessing buffer indices. As an interim workaround, implement input validation and length checks on msgpack messages from untrusted sources before passing them to the decoder, and consider rate limiting or filtering of malformed msgpack data at the network or application layer. Services that do not accept msgpack input from untrusted or unauthenticated sources are not at risk (GitHub Issue #59, Go VulnDB #4513).

The vulnerability was reported directly to the shamaton/msgpack maintainer via GitHub Issue #59 and simultaneously filed with the Go vulnerability database (golang/vulndb #4513), which labeled it a "Direct External Report." The Go security team acknowledged the report and tracked it for inclusion in the Go vulnerability database (GO-2026-4513). SUSE issued a security advisory referencing the CVE, and it was picked up by Linux security aggregators. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been observed (GitHub Issue #59, Go VulnDB #4513).