{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3amessagepackmsgpack/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:messagepack:msgpack:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-126366"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["msgpack"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MessagePack"],"content_html":"\u003cp\u003eThe MessagePack for Ruby library (JRuby-platform msgpack gem) prior to 1.8.7 allocated arrays and byte buffers directly from declared sizes in array32, str32, and bin32 headers before confirming that elements or bytes were available.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eA short MessagePack header could trigger a large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap.\u003c/p\u003e\n","date_modified":"2026-11-13T00:43:30Z","date_published":"2026-11-13T00:43:30Z","id":"https://feed.craftedsignal.io/briefs/2026-11-msgpack-ruby-dos-cve-2026-126366/","summary":"The Java-platform msgpack gem for JRuby in versions prior to 1.8.7 allocated memory based on sizes declared in MessagePack headers before verifying availability, potentially causing JVM heap exhaustion when processing crafted input.","title":"MessagePack for Ruby: Denial of Service via uncontrolled resource allocation (CVE-2026-126366)","url":"https://feed.craftedsignal.io/briefs/2026-11-msgpack-ruby-dos-cve-2026-126366/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:messagepack:msgpack:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}