{"affected":[{"product":"msgpack-ruby","source":"CNA: GitHub_M","vendor":"msgpack","versions":[{"status":"affected","version":"< 1.8.7"}]},{"defaultStatus":"unaffected","ecosystem":"RubyGems","packageName":"msgpack","product":"msgpack","source":"OSV GHSA-73v3-wf97-vpgj","vendor":"","versions":[{"status":"affected","version":"0.0.1","versionType":"RubyGems"},{"status":"affected","version":"0.2.0","versionType":"RubyGems"},{"status":"affected","version":"0.2.1","versionType":"RubyGems"},{"status":"affected","version":"0.2.2","versionType":"RubyGems"},{"status":"affected","version":"0.3.0","versionType":"RubyGems"},{"status":"affected","version":"0.3.1","versionType":"RubyGems"},{"status":"affected","version":"0.3.2","versionType":"RubyGems"},{"status":"affected","version":"0.3.3","versionType":"RubyGems"},{"status":"affected","version":"0.3.4","versionType":"RubyGems"},{"status":"affected","version":"0.3.5","versionType":"RubyGems"},{"status":"affected","version":"0.3.6","versionType":"RubyGems"},{"status":"affected","version":"0.3.7","versionType":"RubyGems"},{"status":"affected","version":"0.3.8","versionType":"RubyGems"},{"status":"affected","version":"0.3.9","versionType":"RubyGems"},{"status":"affected","version":"0.4.0","versionType":"RubyGems"},{"status":"affected","version":"0.4.1","versionType":"RubyGems"},{"status":"affected","version":"0.4.2","versionType":"RubyGems"},{"status":"affected","version":"0.4.3","versionType":"RubyGems"},{"status":"affected","version":"0.4.4","versionType":"RubyGems"},{"status":"affected","version":"0.4.5","versionType":"RubyGems"},{"status":"affected","version":"0.4.6","versionType":"RubyGems"},{"status":"affected","version":"0.4.7","versionType":"RubyGems"},{"status":"affected","version":"0.5.0","versionType":"RubyGems"},{"status":"affected","version":"0.5.1","versionType":"RubyGems"},{"status":"affected","version":"0.5.10","versionType":"RubyGems"},{"status":"affected","version":"0.5.11","versionType":"RubyGems"},{"status":"affected","version":"0.5.12","versionType":"RubyGems"},{"status":"affected","version":"0.5.2","versionType":"RubyGems"},{"status":"affected","version":"0.5.3","versionType":"RubyGems"},{"status":"affected","version":"0.5.4","versionType":"RubyGems"},{"status":"affected","version":"0.5.5","versionType":"RubyGems"},{"status":"affected","version":"0.5.6","versionType":"RubyGems"},{"status":"affected","version":"0.5.7","versionType":"RubyGems"},{"status":"affected","version":"0.5.8","versionType":"RubyGems"},{"status":"affected","version":"0.5.9","versionType":"RubyGems"},{"status":"affected","version":"0.6.0","versionType":"RubyGems"},{"status":"affected","version":"0.6.0pre1","versionType":"RubyGems"},{"status":"affected","version":"0.6.1","versionType":"RubyGems"},{"status":"affected","version":"0.6.2","versionType":"RubyGems"},{"status":"affected","version":"0.7.0","versionType":"RubyGems"},{"status":"affected","version":"0.7.0dev1","versionType":"RubyGems"},{"status":"affected","version":"0.7.1","versionType":"RubyGems"},{"status":"affected","version":"0.7.2","versionType":"RubyGems"},{"status":"affected","version":"0.7.2dev1","versionType":"RubyGems"},{"status":"affected","version":"0.7.3","versionType":"RubyGems"},{"status":"affected","version":"0.7.4","versionType":"RubyGems"},{"status":"affected","version":"0.7.5","versionType":"RubyGems"},{"status":"affected","version":"0.7.6","versionType":"RubyGems"},{"status":"affected","version":"1.0.0","versionType":"RubyGems"},{"status":"affected","version":"1.0.1","versionType":"RubyGems"},{"status":"affected","version":"1.0.2","versionType":"RubyGems"},{"status":"affected","version":"1.0.3","versionType":"RubyGems"},{"status":"affected","version":"1.1.0","versionType":"RubyGems"},{"status":"affected","version":"1.2.0","versionType":"RubyGems"},{"status":"affected","version":"1.2.1","versionType":"RubyGems"},{"status":"affected","version":"1.2.10","versionType":"RubyGems"},{"status":"affected","version":"1.2.2","versionType":"RubyGems"},{"status":"affected","version":"1.2.3","versionType":"RubyGems"},{"status":"affected","version":"1.2.4","versionType":"RubyGems"},{"status":"affected","version":"1.2.5","versionType":"RubyGems"},{"status":"affected","version":"1.2.6","versionType":"RubyGems"},{"status":"affected","version":"1.2.7","versionType":"RubyGems"},{"status":"affected","version":"1.2.8","versionType":"RubyGems"},{"status":"affected","version":"1.2.9","versionType":"RubyGems"},{"status":"affected","version":"1.3.0","versionType":"RubyGems"},{"status":"affected","version":"1.3.1","versionType":"RubyGems"},{"status":"affected","version":"1.3.2","versionType":"RubyGems"},{"status":"affected","version":"1.3.3","versionType":"RubyGems"},{"status":"affected","version":"1.4.0","versionType":"RubyGems"},{"status":"affected","version":"1.4.0.pre1","versionType":"RubyGems"},{"status":"affected","version":"1.4.1","versionType":"RubyGems"},{"status":"affected","version":"1.4.2","versionType":"RubyGems"},{"status":"affected","version":"1.4.3","versionType":"RubyGems"},{"status":"affected","version":"1.4.4","versionType":"RubyGems"},{"status":"affected","version":"1.4.4.pre1","versionType":"RubyGems"},{"status":"affected","version":"1.4.5","versionType":"RubyGems"},{"status":"affected","version":"1.5.0","versionType":"RubyGems"},{"status":"affected","version":"1.5.1","versionType":"RubyGems"},{"status":"affected","version":"1.5.2","versionType":"RubyGems"},{"status":"affected","version":"1.5.3","versionType":"RubyGems"},{"status":"affected","version":"1.5.4","versionType":"RubyGems"},{"status":"affected","version":"1.5.5","versionType":"RubyGems"},{"status":"affected","version":"1.5.6","versionType":"RubyGems"},{"status":"affected","version":"1.6.0","versionType":"RubyGems"},{"status":"affected","version":"1.6.1","versionType":"RubyGems"},{"status":"affected","version":"1.7.0","versionType":"RubyGems"},{"status":"affected","version":"1.7.1","versionType":"RubyGems"},{"status":"affected","version":"1.7.2","versionType":"RubyGems"},{"status":"affected","version":"1.7.3","versionType":"RubyGems"},{"status":"affected","version":"1.7.4","versionType":"RubyGems"},{"status":"affected","version":"1.7.5","versionType":"RubyGems"},{"status":"affected","version":"1.8.0","versionType":"RubyGems"},{"status":"affected","version":"1.8.1","versionType":"RubyGems"},{"status":"affected","version":"1.8.2","versionType":"RubyGems"},{"status":"affected","version":"1.8.3","versionType":"RubyGems"},{"status":"affected","version":"1.8.4","versionType":"RubyGems"},{"status":"affected","version":"1.8.5","versionType":"RubyGems"},{"status":"affected","version":"1.8.6","versionType":"RubyGems"},{"events":[{"introduced":"0"},{"fixed":"1.8.7"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-126366","cwes":["CWE-770","CWE-1325"],"description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding elements or bytes were available. A short MessagePack header could therefore trigger a very large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap. map32 and declared counts at or above 2^31 did not use the affected allocation behavior. This issue is fixed in version 1.8.7.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794524405611,"publishedAt":1794523298409,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-73v3-wf97-vpgj"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-73v3-wf97-vpgj"}],"remediation":[{"kind":"fix","source":"OSV GHSA-73v3-wf97-vpgj","text":"msgpack (RubyGems): OSV reports a fixed version 1.8.7. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-73v3-wf97-vpgj"}],"revision":"dab2eb9d8df97637253ca35df075b3cdc7f1443f2c2e560856f9fb086c18dbd9","sources":[{"modifiedAt":1794523298409,"name":"CNA: GitHub_M","retrievedAt":1794524933815,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126366"},{"modifiedAt":1794524405611,"name":"OSV / GitHub Security Advisories","retrievedAt":1794524934488,"url":"https://osv.dev/vulnerability/GHSA-73v3-wf97-vpgj"}],"ssvc":null,"status":"published","title":"msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM","updatedAt":1794524934488}