x/vulndb: update fixed versions for GO-2026-4513 / duplicate GO-2026-4740

[shamaton]

Report IDs

• GO-2026-4513
• GO-2026-4740

Suggested edit

Please update the Go vulnerability database entries for shamaton/msgpack fixext DoS.

For GO-2026-4513:

• Add fixed version 2.4.1 for module github.com/shamaton/msgpack/v2.
• Add fixed version 3.1.1 for module github.com/shamaton/msgpack/v3.
• Keep module github.com/shamaton/msgpack (v1) as no known fixed version, unless the Go team has contrary evidence.
• Add alias/reference GHSA-h9q6-hc68-35rp, since GO-2026-4740 describes the same vulnerability from the GHSA source.

For GO-2026-4740:

• This appears to be a duplicate of GO-2026-4513. Please withdraw/exclude/merge it as appropriate, or apply the same fixed-version data if it must remain served.

Evidence

• v3 fix PR: fix: validate ext frame bounds before byte-slice decode shamaton/msgpack#60

  • Merged on 2026-05-12.
  • Merge commit: shamaton/msgpack@269f54e
  • Release containing the fix: https://github.com/shamaton/msgpack/releases/tag/v3.1.1

• v2 fix release: https://github.com/shamaton/msgpack/releases/tag/v2.4.1

  • Release notes mention: "Backport ext frame bounds validation to v2" and regression tests for truncated ext/timestamp payloads.

• Original vuln report: x/vulndb: potential Go vuln in github.com/shamaton/msgpack #4513

• Duplicate/generated GHSA report: x/vulndb: potential Go vuln in github.com/shamaton/msgpack/v3: GHSA-h9q6-hc68-35rp #4740

• GHSA: GHSA-h9q6-hc68-35rp

Current incorrect behavior

As of 2026-05-24, pkg.go.dev/vuln still shows all versions, no known fixed for v2 and v3 in both reports, which makes fixed consumers of github.com/shamaton/msgpack/v2@v2.4.1 and github.com/shamaton/msgpack/v3@v3.1.1 look vulnerable.

Thanks.

[shamaton]

Maintainer clarification for v1:

The v1 module (github.com/shamaton/msgpack) is obsolete/unmaintained, and I do not plan to publish a v1 fix release. Users should migrate to the maintained v2 or v3 release lines.

So the requested fixed-version updates are only:

• github.com/shamaton/msgpack/v2: fixed in v2.4.1
• github.com/shamaton/msgpack/v3: fixed in v3.1.1

For github.com/shamaton/msgpack v1, please keep it as no known fixed version, or add any appropriate note/metadata indicating that the line is obsolete and users should migrate.