MessagePack Vulnerability (CVE-2026-126366)

Life Of This Page

1. 1
   Born
   Nov 13 00:20 UTC
   A second, independent source names it.
2. 2
   Developing · Now
   Nov 13 00:20 UTC
   New signals join; severity can move.
3. 3
   Confirmed
   Not yet
   CISA KEV lists it, or exploitation in the wild is reported.
4. 4
   Resolved
   Not yet
   Past the fix deadline and 14 days with no new signal.
5. 5
   Archived
   Not yet
   30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The ID never changes, and earlier addresses keep working. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

1. Disclosed: reached
   Nov 13 00:20 UTC
   C6 NVD published
2. Scored: reached
   Nov 13 00:20 UTC
   CVSS 7.5
3. Exploited: not yet
   Not yet
   No exploitation reported
4. Advisories: not yet
   Not yet
   None yet
5. Vendor Response: not yet
   Not yet
   None in sources yet
6. Resolved: not yet
   Not yet
   After 14 quiet days

Timeline

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.