Cpe:2.3:a:messagepack:msgpack:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amessagepackmsgpack/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 13 Nov 2026 00:43:30 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMessagePack for Ruby: Denial of Service via uncontrolled resource allocation (CVE-2026-126366)https://feed.craftedsignal.io/briefs/2026-11-msgpack-ruby-dos-cve-2026-126366/Fri, 13 Nov 2026 00:43:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-msgpack-ruby-dos-cve-2026-126366/The Java-platform msgpack gem for JRuby in versions prior to 1.8.7 allocated memory based on sizes declared in MessagePack headers before verifying availability, potentially causing JVM heap exhaustion when processing crafted input.The MessagePack for Ruby library (JRuby-platform msgpack gem) prior to 1.8.7 allocated arrays and byte buffers directly from declared sizes in array32, str32, and bin32 headers before confirming that elements or bytes were available.

Impact

A short MessagePack header could trigger a large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap.

]]>lowadvisory