EUVD-2026-124750

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366

The msgpack-ruby gem for the JRuby platform (versions prior to 1.8.7 ) is vulnerable to a memory exhaustion issue. The msgpack-java decoder incorrectly allocates arrays and byte buffers based on attacker-controlled sizes provided in array32 , str32 , and bin32 headers without verifying the availa...