CVE-2026-54522

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Bufferclear in ext/msgpack/buffer.c leaves rmemlast, rmemend, and rmemowner stale after msgpackbuffershiftchunk returns an rmem page to the shared pool, allowing a subsequent...

PT-2026-66639

Summary MessagePack::Bufferclear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor rmem last, rmem end, rmem owner. The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has...