CVE-2026-126366 msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM

The msgpack-ruby gem for the JRuby platform (versions prior to 1.8.7 ) is vulnerable to a memory exhaustion issue. The msgpack-java decoder incorrectly allocates arrays and byte buffers based on attacker-controlled sizes provided in array32 , str32 , and bin32 headers without verifying the availa...