CVE-2026-126366
Received Received - Intake

Heap Exhaustion in MessagePack for Ruby

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: GitHub, Inc.

Description
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding elements or bytes were available. A short MessagePack header could therefore trigger a very large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap. map32 and declared counts at or above 2^31 did not use the affected allocation behavior. This issue is fixed in version 1.8.7.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126366

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
msgpack msgpack-ruby to 1.8.7 (exc)
msgpack msgpack-ruby 1.8.7
msgpack msgpack 1.8.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1325 The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in MessagePack for Ruby (versions before 1.8.7) involves unsafe memory allocation when decoding untrusted input. The Java-platform msgpack gem for JRuby would allocate large arrays or buffers based on attacker-controlled size declarations (array32, str32, bin32) without verifying available data. A short MessagePack header could trigger massive heap growth or allocation attempts, potentially exhausting the JVM heap.

Detection Guidance

Monitor for unexpected memory spikes or OutOfMemoryError exceptions in JRuby-based applications using msgpack-java versions <= 1.8.6. Check application logs for large memory allocations triggered by malformed MessagePack input.

Impact Analysis

An attacker could send a specially crafted MessagePack message to cause denial-of-service in JRuby-based applications. This may lead to OutOfMemoryError exceptions, silent heap exhaustion, or degraded performance. Applications using msgpack-java for JRuby, including Rails, Logstash pipelines, or JVM polyglot stacks, are vulnerable if they process untrusted input.

Compliance Impact

This vulnerability primarily impacts system availability and reliability. While not directly violating GDPR or HIPAA, it could lead to service disruptions that compromise data processing integrity or availability, potentially violating requirements for secure and reliable systems handling sensitive data.

Mitigation Strategies

Upgrade msgpack-java to version 1.8.7 or later. If upgrading is not immediately possible, implement input validation to reject messages with excessively large declared sizes (e.g., array32, str32, bin32 values >= 2^31).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126366. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...