68918 matches found
msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM
Summary The JRuby implementation of msgpack msgpack gem, java platform — pure Java decoder under ext/java/ sizes containers directly from the element count written in the message header, with no cap at all: no equivalent of the C unpacker's SHRTMAX clamp since 1.7.3 and none of the buffered-bytes...
7.5CVSS5.8AI score
SaveExploits0References5Affected Software1
20