CVE-2026-126366

Name of the Vulnerable Software and Affected Versions msgpack versions prior to 1.8.7

Description In the Java-platform implementation of the msgpack gem for JRuby, the decoder allocates memory for arrays and byte buffers based on the size declared in the message header before verifying if the actual elements or bytes are available. An attacker can send a short MessagePack header to trigger very large memory allocations or sustained heap growth, potentially leading to a java.lang.OutOfMemoryError and exhausting the shared JVM heap. This can destabilize or crash the entire JVM process, affecting all threads and connections.

The issue specifically affects the following components:

Note that map32 and declared counts at or above 2^31 are not affected by this behavior.

Recommendations Update msgpack to version 1.8.7. As a temporary workaround, restrict the use of MessagePack.unpack and MessagePack::Unpacker when processing untrusted input.