ROOT-APP-PYPI-CVE-2026-114613 CVE-2026-114613 in msgpack - Patched by Root

Root has patched CVE-2026-114613 in the msgpack package for Root:PyPI. Multiple fixed versions available...

CVE-2026-126366

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366: msgpack msgpack-ruby: MessagePack for Ruby is an implementation of the MessagePack binary serialization format

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

GHSA-73V3-WF97-VPGJ msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM

Summary The JRuby implementation of msgpack msgpack gem, java platform — pure Java decoder under ext/java/ sizes containers directly from the element count written in the message header, with no cap at all: no equivalent of the C unpacker's SHRTMAX clamp since 1.7.3 and none of the buffered-bytes...

msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM

Summary The JRuby implementation of msgpack msgpack gem, java platform — pure Java decoder under ext/java/ sizes containers directly from the element count written in the message header, with no cap at all: no equivalent of the C unpacker's SHRTMAX clamp since 1.7.3 and none of the buffered-bytes...

CVE-2026-126366

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366 msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

EUVD-2026-124750

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366 msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding...

CVE-2026-126366

The msgpack-ruby gem for the JRuby platform (versions prior to 1.8.7 ) is vulnerable to a memory exhaustion issue. The msgpack-java decoder incorrectly allocates arrays and byte buffers based on attacker-controlled sizes provided in array32 , str32 , and bin32 headers without verifying the availa...

msgpack-CVE-2021-23410-test

Test for https://snyk.io/vuln/SNYK-JS-MSGPACK-1296122 This looks like not vulerbility. var assert = require'assert'; var msgpack = require'msgpack'; function sleepms return new Promiseresolve = setTimeoutresolve, ms; ; async function init var normal = "a": 1, "b": 2, "c": 1, 2, 3 ; var malicious ...

PT-2026-146089

Summary The JRuby implementation of msgpack msgpack gem, java platform — pure Java decoder under ext/java/ sizes containers directly from the element count written in the message header, with no cap at all: no equivalent of the C unpacker's SHRT MAX clamp since 1.7.3 and none of the buffered-byte...

CVE-2026-106972

A flaw was found in rybakit/msgpack. An attacker can cause a Denial of Service DoS by supplying specially crafted input to the data unpacking component. Due to uncontrolled recursion, processing this malicious input leads to excessive resource exhaustion and crashes the application...

CLEANSTART-2026-YQ52198 MessagePack is the serializer implementation for Python msgpack

Security vulnerability affects the miniforge3 package. MessagePack is the serializer implementation for Python msgpack...

CLEANSTART-2026-XV36403 MessagePack is the serializer implementation for Python msgpack

CVE-2026-114613 affects multiple packages. MessagePack is the serializer implementation for Python msgpack. See references for individual vulnerability details...

msgpack-python DoS

The vulnerability in the Python library for MessagePack serialization msgpack-python stems from insufficient resource control during its existence. Exploitation of this vulnerability could allow a remote attacker to cause a denial of service...

CVE-2026-114613 affecting package python-msgpack for versions less than 1.2.3-1

CVE-2026-114613 affecting package python-msgpack for versions less than 1.2.3-1. An upgraded version of the package is available that resolves this issue...

Linux Distros Unpatched Vulnerability : CVE-2026-106972

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in MessagePack\BufferUnpacker::unpack in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through...

MessagePack: Unbounded Memory Leak In Msgpack C Extension On Strict_map_key Validation Failure

Impact The msgpack-python C extension "msgpack.cmsgpack" leaks a decoded map value when deserialization rejects a key with "strictmapkey=True" the default. Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlle...

CVE-2026-106972

Uncontrolled recursion in MessagePack\BufferUnpacker::unpack in rybakit/msgpack versions prior to 0.11.0 allows attackers to cause a denial of service through memory exhaustion when an application decodes deeply nested, attacker-controlled MessagePack input...