msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM

Summary The JRuby implementation of msgpack msgpack gem, java platform — pure Java decoder under ext/java/ sizes containers directly from the element count written in the message header, with no cap at all: no equivalent of the C unpacker's SHRTMAX clamp since 1.7.3 and none of the buffered-bytes...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the clear function. An attacker can access or manipulate memory contents from another buffer by triggering the reuse of a memory page after it has been returned to the shared pool, leading to unintended disclosure or...