Vulnerability in MessagePack for Ruby Affects Java-platform Gem for JRuby

CVE-2026-126366

What is CVE-2026-126366?

The MessagePack for Ruby library before version 1.8.7 contains a vulnerability that allows an attacker to trigger large memory allocations or heap exhaustion through untrusted input. This issue arises when the Java-platform msgpack gem for JRuby allocates arrays and byte buffers based on attacker-controlled sizes without confirming the availability of the necessary elements or bytes. A specially crafted MessagePack header can lead to significant heap growth, exhausting the shared JVM heap during the unpacking process. This vulnerability has been addressed in version 1.8.7, and users are encouraged to upgrade to mitigate potential risks.

References