MessagePack for Ruby: Denial of Service via uncontrolled resource allocation (CVE-2026-126366)
The Java-platform msgpack gem for JRuby in versions prior to 1.8.7 allocated memory based on sizes declared in MessagePack headers before verifying availability, potentially causing JVM heap exhaustion when processing crafted input.
CVE search metadata
CVE search record: CVE-2026-126366. Severity: high. CVSS: 7.5. KEV: no. Product: msgpack. Brief: MessagePack for Ruby: Denial of Service via uncontrolled resource allocation (CVE-2026-126366). Brief link: https://feed.craftedsignal.io/briefs/2026-11-msgpack-ruby-dos-cve-2026-126366/
Triage facts
Revision 1- Applicability
- msgpack
- Evidence
- Unknown
- Severity
- Low
- Sources
- 1 public source
- Freshness
- Revision 1Nov 13, 00:43 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The MessagePack for Ruby library (JRuby-platform msgpack gem) prior to 1.8.7 allocated arrays and byte buffers directly from declared sizes in array32, str32, and bin32 headers before confirming that elements or bytes were available.
Impact
A short MessagePack header could trigger a large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap.