CVE-2026-126366msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM
- 7.5HighCVSS base score
- —Exploitation in 30 daysno EPSS score yet
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding elements or bytes were available. A short MessagePack header could therefore trigger a very large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap. map32 and declared counts at or above 2^31 did not use the affected allocation behavior. This issue is fixed in version 1.8.7.
Timeline
ID reserved
By GitHub_M
- 2 days later
· 2 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- Not scored
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected < 1.8.7
References
References4
- https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj (opens in a new tab)x_refsource_CONFIRM
- https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2 (opens in a new tab)x_refsource_MISC
- https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6 (opens in a new tab)x_refsource_MISC
- https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-126366)Record last updated .