UBUNTU-CVE-2026-126366: High severity ubuntu/ruby-msgpack vulnerability
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes before confirming that corresponding elements or bytes were available. A short MessagePack header could therefore trigger a very large allocation or sustained heap growth when an application decoded untrusted input through MessagePack.unpack or MessagePack::Unpacker, potentially exhausting the shared JVM heap. map32 and declared counts at or above 2^31 did not use the affected allocation behavior. This issue is fixed in version 1.8.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.7
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments using the Java-platform msgpack gem with JRuby before version 1.8.7 are exposed when they decode untrusted MessagePack data through MessagePack.unpack or MessagePack::Unpacker. The impact can extend to other workloads sharing the same JVM heap.
What does an attacker need to do to trigger the denial of service?
An attacker needs to provide crafted MessagePack input containing array32, str32, or bin32 declared sizes that cause large allocations before the decoder verifies that the corresponding data is present. No authentication or user interaction is required according to the supplied severity vector.
Are all large MessagePack declared sizes handled in the same vulnerable way?
No. map32 values and declared counts at or above 2^31 did not use the affected allocation behavior. The affected allocation paths involve array32, str32, and bin32 declared sizes.
What is the available fix?
Update the Java-platform msgpack gem for JRuby to version 1.8.7, which fixes the issue.