AIKIDO-2026-360897

TL;DR

The msgpack deserializer unpacks MessagePack from buffer-protocol objects in its C extension and pure-Python fallback. When input is a non-contiguous buffer such as a sliced memoryview, the C path could use freed memory and abort the process, and error or re-init paths could leak parser state on malformed payloads. Before the fix, strict_map_key was not enforced when object_pairs_hook was configured, allowing non-string map keys despite the option. Version 1.2.0 fixes buffer lifetime handling, clears partial unpack state, adds missing C allocation checks, and applies map-key validation in the hook path.