Skip to content
Threat Feed
Subscribe

Product

Msgpack

1 brief RSS
low advisory

MessagePack for Ruby: Denial of Service via uncontrolled resource allocation (CVE-2026-126366)

The Java-platform msgpack gem for JRuby in versions prior to 1.8.7 allocated memory based on sizes declared in MessagePack headers before verifying availability, potentially causing JVM heap exhaustion when processing crafted input.

msgpack
1c