{"id":"CVE-2026-126366","kind":"vulnerability","aliases":["CVE-2026-126366","GHSA-73v3-wf97-vpgj"],"related":[],"title":"msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM","description":"### Summary\n\nThe **JRuby** implementation of msgpack (`msgpack` gem, `java` platform — pure Java decoder under `ext/java/`) sizes containers directly from the element count written in the message header, with **no cap at all**: no equivalent of the C unpacker's `SHRT_MAX` clamp (since 1.7.3) and none of the buffered-bytes cap that commit c8d42d8 added for CRuby in 1.8.6. A single 5-byte message decides how much memory a JVM process tries to allocate:\n\n* `array32` header declaring `0x7FFFFFFF` elements → `new IRubyObject[0x7FFFFFFF]` (~8 GiB of reference slots) attempted immediately → `java.lang.OutOfMemoryError: Requested array size exceeds VM limit`.\n* Counts *below* the VM's max-array-size but above available heap (e.g. 5×10⁸ with a 512 MiB heap) produce a **real allocation attempt** — `OutOfMemoryError: Java heap space` — the JVM genuinely tries to take the memory before failing.\n* `str32`/`bin32` headers declaring `0x7FFFFFFF` bytes do the same via `readBytes(size)` → `new byte[size]`.\n* Below the failure threshold there is a **silent band**: one streaming unpacker fed only an `array32` header with count 2×10⁷ (5 wire bytes, zero elements) grows used heap **+78 MiB immediately**, no exception (`each` swallows the underflow), and the footprint stays elevated after `Unpacker#reset` + full GC. Linear in declared count (~4 B/element); nothing bounds it — not delivered bytes, not a per-container cap.\n\nOnly counts ≥ 2³¹ are refused (a clean `MessagePack::UnderflowError` from `getUnsignedInt()`), and only **maps** are safe (`consumeHash` grows per element instead of pre-sizing). Verified on the released gem `msgpack 1.8.6 java`, JRuby 9.4.12 / OpenJDK 25, 2026-10-30 — i.e. **unfixed in the current release**. Proposed fix mirrors c8d42d8: cap initial allocation by bytes actually buffered and grow as data arrives; read strings in bounded chunks instead of allocating the declared length up front.\n\n\n### Details\n\n### 1. The four dispatch arms, and which pre-allocate (line numbers at tag v1.8.6 — current release; `ext/java` has no commits after it)\n\n| header | dispatch ([Decoder.java](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java)) | behaviour on the declared count | measured (released 1.8.6-java, Xmx512m) |\n|---|---|---|---|\n| `array32` `\\xdd` | [:296](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L296) → [`consumeArray(int size)` :139-145](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L139-L145) | `new IRubyObject[size]` **immediately**, before reading any element | count `0x7FFFFFFF`: OOME \"Requested array size exceeds VM limit\"; count 5×10⁸: OOME \"**Java heap space**\" (real allocation attempt); count 2×10⁷: **+78 MiB, silent** |\n| `str32` `\\xdb` | [:294](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L294) → [`consumeString` :129](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L129) → [`readBytes(int size)` :186-190](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L186-L190) | `new byte[size]` **immediately** | len `0x7FFFFFFF`: OOME \"array size exceeds VM limit\" |\n| `bin32` `\\xc6` | [:269](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L269) → same `consumeString`/`readBytes` | same | len `0x7FFFFFFF`: OOME \"array size exceeds VM limit\" |\n| `map32` `\\xdf` | [:298](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L298) → [`consumeHash(int size)` :147+](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L147) | **no pre-allocation** — inserts per element, underflows on first missing byte | count `0x7FFFFFFF`: no exception (swallowed), no large allocation |\n\nThe only guard is [`getUnsignedInt()` :88-94](https://github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/Decoder.java#L88-L94): counts with the top bit set (≥ 2³¹) raise `MessagePack::UnderflowError: Size too large (limited to 2**31 for the Java version)`. That bounds the *value* but leaves the entire positive band `(available heap, 2³¹)` unbounded — and that band is where real allocation attempts happen.\n\n### 2. Contrast with the C implementation (same repo)\n\nThe CRuby unpacker has had a per-container cap since 1.7.3 (`INITIAL_BUFFER_CAPACITY_MAX = SHRT_MAX`) and, since [c8d42d8](https://github.com/msgpack/msgpack-ruby/commit/c8d42d8) in **1.8.6**, additionally caps initial size by bytes actually buffered (\"an element needs at least one byte…\"). Strings on C are bounded too (`read_raw_body_cont` allocates `min(remaining, buffered)`). The Java decoder has **neither generation of cap** — it is strictly behind the CRuby behaviour this repo already considers correct enough to ship.\n\n### 3. Silent retention + mechanism control (measured 2026-10-30, released gem)\n\nOne `MessagePack::Unpacker` per process, fed only a header (`\"\\xdd\" + [count].pack('N')`), zero elements; heap = `Runtime.total_memory - free_memory` after `GC.start` on both sides:\n\n| declared count | used heap before → after | delta | exception? |\n|---|---|---|---|\n| 1,000,000 | 26.4 → 31.1 MiB | +4.7 | none (`each` swallows the underflow) |\n| 5,000,000 | 53.3 → 74.0 MiB | +20.7 | none |\n| 20,000,000 | 51.3 → 129.3 MiB | **+78.0** | none |\n\nMechanism control: after the feed, `Unpacker#reset` + three `GC.start` cycles left used heap at **+79.4 MiB above baseline** (2×10⁷ arm) — the elevation is *not* unpacker-held state; it is JVM heap already spent on header-declared allocation and not returned. Either way the process footprint grows per attack and stays grown; the peak cost is paid synchronously during parsing regardless of GC behaviour afterwards. (Honest scope note: this is unbounded **allocation**, not a memory leak.)\n\n### 4. Why JVM makes availability impact worse than the CRuby analogue\n\nIn CRuby, allocation failure raises `NoMemoryError`/fails inside one worker process. In a JVM, an OOME raised on the parser thread can land anywhere in the host application's shared runtime — long-lived JRuby servers (Rails, Logstash-class pipelines, JDBC apps) share heap across all threads and connections; a single crafted message can destabilize or kill the whole JVM, not just the request. The silent band means no exception at all is even required to spend memory.\n\n### 5. Not claimed / scope\n\n* **Fluentd is NOT affected** (and this report deliberately does not involve it): Fluentd ships CRuby-only — CI pins `engine: cruby`, gemspec requires ruby >= 3.3 while JRuby 9.4 implements Ruby 3.1 semantics, and there are zero JRUBY guards in lib/. This is an upstream msgpack-ruby report only.\n* Maps (`map32`) do not pre-allocate — measured; the class applies to `array32`/`str32`/`bin32`.\n* Counts ≥ 2³¹ are cleanly refused — measured; no claim there.\n* Older java-gem releases were not individually probed; `<= 1.8.6` means \"every release up to the current one carries this code\".\n\n\n### Proof of concept\n\nVerified on the **released gem** `msgpack 1.8.6 java`, JRuby 9.4.12.0, OpenJDK 25.0.4.1, Linux x86-64 (artifacts in `evidence_186_recheck/`). Always run with a small `-Xmx` so oversized requests fail fast instead of wrecking the box.\n\n### Setup\n\n```console\n$ curl -fsSLO https://repo1.maven.org/maven2/org/jruby/jruby-dist/9.4.12.0/jruby-dist-9.4.12.0-bin.tar.gz\n$ tar xzf jruby-dist-9.4.12.0-bin.tar.gz && export PATH=$PWD/jruby-9.4.12.0/bin:$PATH\n$ jruby -S gem install msgpack --no-document      # resolves the java-platform gem: \"msgpack (1.8.6 java)\"\n```\n\n### 1. Header shapes (fresh process per arm, `-Xmx512m`)\n\n```console\narray32 count=0xFFFFFFFF       -> MessagePack::UnderflowError: Size too large (limited to 2**31 for the Java version)\narray32 count=0x7FFFFFFF       -> Java::JavaLang::OutOfMemoryError: Requested array size exceeds VM limit\narray32 count=500000000        -> Java::JavaLang::OutOfMemoryError: Java heap space   # real allocation attempt\nstr32   len=0x7FFFFFFF         -> Java::JavaLang::OutOfMemoryError: Requested array size exceeds VM limit\nbin32   len=0x7FFFFFFF         -> Java::JavaLang::OutOfMemoryError: Requested array size exceeds VM limit\nmap32   count=0x7FFFFFFF       -> no exception, no large allocation (consumeHash grows per element)\n```\n\nEach payload is five bytes, e.g. `\"\\xdd\" + [count].pack('N')` fed to `MessagePack::Unpacker#feed_each`. Scripts: `jr_probe.rb`, `jr_probe_extra.rb` (attached in kit).\n\n### 2. Silent band — retention from one header (Xmx1g)\n\n```console\n$ for n in 1000000 5000000 20000000; do jruby -J-Xmx1g jr_one.rb $n; done\ncount=  1000000 heap 26.4 -> 31.1 MiB (delta 4.7)   | no exception (underflow swallowed)\ncount=  5000000 heap 53.3 -> 74.0 MiB (delta 20.7)  | no exception (underflow swallowed)\ncount= 20000000 heap 51.3 -> 129.3 MiB (delta 78.0) | no exception (underflow swallowed)\n\n$ jruby -J-Xmx1g jr_reset_control.rb 20000000\ncount=20000000 heap base=49.9 after_feed=129.3 (delta 79.4) after_reset_gc=129.3 (retained_vs_base 79.4)\n```\n\nA streaming server that keeps one unpacker per connection (the pattern any socket-fed msgpack service uses) pays this per connection with five wire bytes each and produces no exception, no log line.\n\n### 3. Fix verification path\n\nApply the C-side idea from c8d42d8: in `consumeArray`, cap the initial array by bytes actually buffered (an element needs ≥ 1 byte) and grow as elements arrive; in `readBytes`/`consumeString`, read in bounded chunks instead of allocating the declared length up front. Then re-run this PoC: the silent band should track delivered bytes, and oversized declarations should raise `UnderflowError`-class errors without touching multi-GiB allocations. msgpack-ruby CI runs jruby-9.4/truffleruby, so a patch is verifiable as-is; I can prepare one against `ext/java/org/msgpack/jruby/Decoder.java`.\n\n\n### Impact\n\n**Type.** Uncontrolled resource consumption driven by *declared* sizes rather than delivered bytes — CWE-770 (Allocation of Resources Without Limits or Throttling), precisely CWE-1325 (Independent Resource Usage Limiting Not Applied). Availability only; no confidentiality/integrity impact, no code execution.\n\n**Who is impacted.** Any JRuby application that feeds untrusted msgpack to `MessagePack.unpack`/`Unpacker` — the java-platform gem's whole user base (JRuby-based services, log/RPC pipelines, JVM polyglot stacks using this gem). For them: remote OOM of a shared-heap JVM from a 5-byte message, or silent heap spend below the exception band.\n\n**Severity.** Proposed **High / 7.5**, `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` — remote, trivially crafted, default settings, process death; same metric string as the accepted fluentd OOM family (e.g. GHSA-h3xv-5jpx-r4j2) and as this repo's own C-side analogue (reported separately, patched at 1.8.6). If triage weighs the platform scope (java gem only), lower framings read against that — we flag it honestly; the maintainers' call on scope shouldn't delay the patch.\n\n**Relationship to the C-side report.** Same flaw class, different implementation and fix state: CRuby's pre-allocation was capped by c8d42d8 (released 1.8.6, separate advisory with affected `<= 1.8.5`, patched `1.8.6`). This JRuby variant is **unfixed in 1.8.6** and needs its own patch + CVE. Cross-reference both ways once filed.\n\n**What this is not.** Not a Fluentd issue (Fluentd is CRuby-only — CI pins cruby, gemspec ruby >= 3.3 vs JRuby's Ruby 3.1 semantics); no fluentd advisory should carry this. Not a memory leak (measured: footprint elevation persists after reset+GC without retained objects). Not exploitable via maps or counts ≥ 2³¹ (both measured safe/cleanly refused).","summary":"The Java (JRuby) decoder of the msgpack gem allocates memory based on element counts declared in the message header without any cap, so a 5-byte message can make the JVM attempt multi-gigabyte allocations. An attacker who can send msgpack data to a JRuby process can exhaust its heap and cause an out-of-memory failure, affecting availability.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"msgpack","fixed":["1.8.7"],"affected":"<= 1.8.6","ecosystem":"rubygems"}],"ecosystems":["rubygems"],"tags":["cwe-1325","cwe-770","java","jruby","logstash","msgpack","package","rails","rubygems"],"not_affected_if":["cruby-only","no-untrusted-msgpack-input"],"how_to_check":"- Run `jruby -S gem list msgpack` and check whether the java-platform msgpack version is `1.8.6` or earlier.\n- Check whether your application feeds untrusted msgpack input to `MessagePack.unpack` or `MessagePack::Unpacker` under JRuby.","fix":"- msgpack (rubygems, java platform): move to `1.8.7`, the fixed version in the product data.","status":"open","published_at":"2026-11-12T22:54:59+00:00","first_seen_at":"2026-11-12T22:57:32+00:00","triaged_at":"2026-11-12T22:59:09+00:00","updated_at":"2026-11-12T22:59:09+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T22:59:09Z","model":"claude-haiku-5-5","output":{"fix":"- msgpack (rubygems, java platform): move to `1.8.7`, the fixed version in the product data.","reach":"network","title":"msgpack-ruby JRuby decoder: 5-byte message forces multi-GiB allocation, crashing JVM","impact":"medium","summary":"The Java (JRuby) decoder of the msgpack gem allocates memory based on element counts declared in the message header without any cap, so a 5-byte message can make the JVM attempt multi-gigabyte allocations. An attacker who can send msgpack data to a JRuby process can exhaust its heap and cause an out-of-memory failure, affecting availability.","audience":"developers","category":"package","nicknames":[],"who_cares":["msgpack","jruby","rubygems","java","rails","logstash"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"remote out-of-memory crash of a shared JVM process","analyst_note":"","how_to_check":"- Run `jruby -S gem list msgpack` and check whether the java-platform msgpack version is `1.8.6` or earlier.\n- Check whether your application feeds untrusted msgpack input to `MessagePack.unpack` or `MessagePack::Unpacker` under JRuby.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["cruby-only","no-untrusted-msgpack-input"],"who_is_affected":"Any JRuby application that unpacks untrusted msgpack data with the msgpack gem's java platform build is exposed, such as JRuby services, log or RPC pipelines, and JVM stacks using this gem. The CRuby build is not affected by this specific flaw, and applications that do not decode untrusted msgpack under JRuby can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.001307,"input_tokens":9797,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'+78':286C,482C '-10':361C '-126366':23A,31A '-1325':34B '-145':448C '-190':500C '-2026':22A,30A '-30':362C '-770':36B '-94':573C '/msgpack/msgpack-ru':576C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l129)':495C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l139-l145)':451C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l147)':546C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l186-l190)':503C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l269)':521C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l294)':490C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l296)':443C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l298)':539C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java))':427C '0x7fffffff':183C,187C,246C,461C,509C,527C,560C '1':399C '1.7.3':148C '1.8.6':164C,354C,435C '10':217C,277C,471C,481C '129':492C '139':447C '147':543C '186':499C '2':276C,325C,480C '2026':360C '25':359C '269':518C '294':487C '296':440C '298':536C '4':309C '5':13A,68B,167C,216C,278C,470C '512':220C '73v3':26A '8':188C '88':572C '9.4.12':357C 'actual':378C 'add':160C 'affect':103B 'alloc':11A,52B,79B,179C,226C,375C,392C,408C,477C,550C,566C 'arm':403C 'array':197C,209C,464C,511C,529C 'array32':180C,272C,438C 'arriv':384C 'attack':81B 'attempt':75B,193C,227C,478C 'avail':104B,213C 'b/element':310C 'band':265C 'base':54B 'behaviour':428C 'bin32':243C,516C 'bound':312C,388C 'buffer':154C,379C 'buffered-byt':153C 'byte':14A,69B,155C,168C,247C,255C,280C,316C,377C,505C,558C 'c':141C 'c8d42d8':159C,372C 'cap':65B,134C,156C,322C,373C 'caus':96B 'chunk':389C 'clamp':146C 'clean':329C 'commit':158C,419C 'consumearray':444C 'consumehash':339C,540C 'consumestr':491C,523C 'contain':121C,321C 'count':10A,57B,126C,202C,275C,308C,324C,432C,460C,469C,479C,559C 'crubi':162C 'current':367C,414C 'cve':21A,29A 'cwe':33B,35B 'data':86B,383C 'decid':170C 'declar':58B,182C,245C,307C,394C,431C 'decod':5A,47B,117C 'decoder.java':424C 'deliv':315C 'detail':398C 'direct':122C 'dispatch':402C,423C 'e.g':215C 'element':56B,125C,184C,282C,342C,459C,553C 'elev':299C 'equival':138C 'exceed':199C,466C,513C,531C 'except':290C,562C 'exhaust':92B 'ext/java':119C,416C 'fail':241C 'failur':102B,259C 'fed':269C 'first':556C 'fix':370C 'footprint':297C 'forc':16A 'four':401C 'front':397C 'full':303C 'gc':304C 'gem':51B,112C,352C 'genuin':234C 'getunsignedint':333C,571C 'ghsa':25A 'ghsa-73v3-wf97-vpgj':24A 'gib':19A,189C 'gigabyt':78B 'github.com':426C,442C,450C,489C,494C,502C,520C,538C,545C,575C 'github.com/msgpack/msgpack-ru':574C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l129)':493C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l139-l145)':449C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l147)':544C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l186-l190)':501C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l269)':519C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l294)':488C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l296)':441C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l298)':537C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java))':425C 'grow':283C,340C,381C 'guard':569C 'header':9A,62B,131C,181C,244C,273C,422C 'header-count':8A 'heap':94B,214C,222C,230C,285C,474C 'i.e':363C 'immedi':194C,288C,455C,507C 'implement':108C 'initi':374C 'insert':551C 'instead':343C,390C 'int':445C,497C,541C 'irubyobject':186C,453C 'java':37B,45B,113C,116C,229C,355C,436C,473C 'java.lang.outofmemoryerror':195C 'jrubi':4A,38B,46B,89B,107C,356C 'jvm':74B,175C,233C 'larg':565C 'len':508C,526C 'length':395C 'limit':201C,468C,515C,533C 'line':409C 'linear':305C 'logstash':39B 'make':6A,72B 'map':336C 'map32':534C 'max':145C,208C 'max-array-s':207C 'measur':433C 'memori':53B,101B,173C,239C 'messag':15A,61B,70B,130C,169C 'messagepack':330C 'mib':221C,287C,483C 'mirror':371C 'miss':557C 'msgpack':2A,32A,40B,50B,85B,110C,111C,353C 'msgpack-rubi':1A 'much':172C 'multi':18A,77B 'multi-gib':17A 'multi-gigabyt':76B 'new':185C,254C,452C,504C 'none':150C 'noth':311C 'number':410C 'one':266C 'oom':20A,462C,472C,510C,528C 'openjdk':358C 'out-of-memori':98B 'outofmemoryerror':228C 'packag':41B 'per':320C,341C,552C 'per-contain':319C 'platform':114C 'pre':346C,407C,549C 'pre-alloc':406C,548C 'pre-siz':345C 'process':90B,176C 'produc':223C 'propos':369C 'pure':115C 'rail':42B 'read':385C,457C 'readbyt':252C,496C,524C 'real':225C,476C 'refer':191C 'refus':327C 'releas':351C,368C,415C,434C 'request':196C,463C 'reset':302C 'rubi':3A 'rubygem':43B 'safe':338C 'send':84B 'shrt':144C 'silent':264C,484C 'sinc':147C 'singl':166C 'size':120C,198C,210C,253C,256C,347C,446C,454C,465C,498C,506C,512C,530C,542C 'slot':192C 'space':231C,475C 'stay':298C 'str32':242C,485C 'stream':267C 'string':386C 'summari':105C 'swallow':292C,563C 'tag':412C 'take':237C 'threshold':260C 'tri':177C,235C 'uncap':7A 'underflow':294C,554C 'underflowerror':331C 'unfix':364C 'unpack':142C,268C,301C 'use':284C 'v1.8.6':413C 'verifi':348C 'via':251C 'vm':200C,205C,467C,514C,532C 'vpgj':28A 'wf97':27A 'wire':279C 'without':63B 'written':127C 'xc6':517C 'xdb':486C 'xdd':439C 'xdf':535C 'xmx512m':437C 'zero':281C","nicknames":[],"mitigations":[],"who_affected":"Any JRuby application that unpacks untrusted msgpack data with the msgpack gem's java platform build is exposed, such as JRuby services, log or RPC pipelines, and JVM stacks using this gem. The CRuby build is not affected by this specific flaw, and applications that do not decode untrusted msgpack under JRuby can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["msgpack"],"ptokens":["msgpack"],"labels":["cwe1325","cwe770","high","java","jruby","logstash","msgpack","package","rails","rubygems"],"campaign_type":null,"search_a":"'-126366':23A,31A '-2026':22A,30A '5':13A '73v3':26A 'alloc':11A 'byte':14A 'count':10A 'cve':21A,29A 'decod':5A 'forc':16A 'ghsa':25A 'ghsa-73v3-wf97-vpgj':24A 'gib':19A 'header':9A 'header-count':8A 'jrubi':4A 'make':6A 'messag':15A 'msgpack':2A,32A 'msgpack-rubi':1A 'multi':18A 'multi-gib':17A 'oom':20A 'rubi':3A 'uncap':7A 'vpgj':28A 'wf97':27A","search_b":"'-1325':34B '-770':36B '5':68B 'affect':103B 'alloc':52B,79B 'attack':81B 'attempt':75B 'avail':104B 'base':54B 'byte':69B 'cap':65B 'caus':96B 'count':57B 'cwe':33B,35B 'data':86B 'declar':58B 'decod':47B 'element':56B 'exhaust':92B 'failur':102B 'gem':51B 'gigabyt':78B 'header':62B 'heap':94B 'java':37B,45B 'jrubi':38B,46B,89B 'jvm':74B 'logstash':39B 'make':72B 'memori':53B,101B 'messag':61B,70B 'msgpack':40B,50B,85B 'multi':77B 'multi-gigabyt':76B 'out-of-memori':98B 'packag':41B 'process':90B 'rail':42B 'rubygem':43B 'send':84B 'without':63B","search_c":"'+78':286C,482C '-10':361C '-145':448C '-190':500C '-30':362C '-94':573C '/msgpack/msgpack-ru':576C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l129)':495C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l139-l145)':451C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l147)':546C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l186-l190)':503C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l269)':521C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l294)':490C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l296)':443C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l298)':539C '/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java))':427C '0x7fffffff':183C,187C,246C,461C,509C,527C,560C '1':399C '1.7.3':148C '1.8.6':164C,354C,435C '10':217C,277C,471C,481C '129':492C '139':447C '147':543C '186':499C '2':276C,325C,480C '2026':360C '25':359C '269':518C '294':487C '296':440C '298':536C '4':309C '5':167C,216C,278C,470C '512':220C '8':188C '88':572C '9.4.12':357C 'actual':378C 'add':160C 'alloc':179C,226C,375C,392C,408C,477C,550C,566C 'arm':403C 'array':197C,209C,464C,511C,529C 'array32':180C,272C,438C 'arriv':384C 'attempt':193C,227C,478C 'avail':213C 'b/element':310C 'band':265C 'behaviour':428C 'bin32':243C,516C 'bound':312C,388C 'buffer':154C,379C 'buffered-byt':153C 'byte':155C,168C,247C,255C,280C,316C,377C,505C,558C 'c':141C 'c8d42d8':159C,372C 'cap':134C,156C,322C,373C 'chunk':389C 'clamp':146C 'clean':329C 'commit':158C,419C 'consumearray':444C 'consumehash':339C,540C 'consumestr':491C,523C 'contain':121C,321C 'count':126C,202C,275C,308C,324C,432C,460C,469C,479C,559C 'crubi':162C 'current':367C,414C 'data':383C 'decid':170C 'declar':182C,245C,307C,394C,431C 'decod':117C 'decoder.java':424C 'deliv':315C 'detail':398C 'direct':122C 'dispatch':402C,423C 'e.g':215C 'element':125C,184C,282C,342C,459C,553C 'elev':299C 'equival':138C 'exceed':199C,466C,513C,531C 'except':290C,562C 'ext/java':119C,416C 'fail':241C 'failur':259C 'fed':269C 'first':556C 'fix':370C 'footprint':297C 'four':401C 'front':397C 'full':303C 'gc':304C 'gem':112C,352C 'genuin':234C 'getunsignedint':333C,571C 'gib':189C 'github.com':426C,442C,450C,489C,494C,502C,520C,538C,545C,575C 'github.com/msgpack/msgpack-ru':574C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l129)':493C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l139-l145)':449C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l147)':544C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l186-l190)':501C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l269)':519C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l294)':488C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l296)':441C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java#l298)':537C 'github.com/msgpack/msgpack-ruby/blob/v1.8.6/ext/java/org/msgpack/jruby/decoder.java))':425C 'grow':283C,340C,381C 'guard':569C 'header':131C,181C,244C,273C,422C 'heap':214C,222C,230C,285C,474C 'i.e':363C 'immedi':194C,288C,455C,507C 'implement':108C 'initi':374C 'insert':551C 'instead':343C,390C 'int':445C,497C,541C 'irubyobject':186C,453C 'java':113C,116C,229C,355C,436C,473C 'java.lang.outofmemoryerror':195C 'jrubi':107C,356C 'jvm':175C,233C 'larg':565C 'len':508C,526C 'length':395C 'limit':201C,468C,515C,533C 'line':409C 'linear':305C 'map':336C 'map32':534C 'max':145C,208C 'max-array-s':207C 'measur':433C 'memori':173C,239C 'messag':130C,169C 'messagepack':330C 'mib':221C,287C,483C 'mirror':371C 'miss':557C 'msgpack':110C,111C,353C 'much':172C 'new':185C,254C,452C,504C 'none':150C 'noth':311C 'number':410C 'one':266C 'oom':462C,472C,510C,528C 'openjdk':358C 'outofmemoryerror':228C 'per':320C,341C,552C 'per-contain':319C 'platform':114C 'pre':346C,407C,549C 'pre-alloc':406C,548C 'pre-siz':345C 'process':176C 'produc':223C 'propos':369C 'pure':115C 'read':385C,457C 'readbyt':252C,496C,524C 'real':225C,476C 'refer':191C 'refus':327C 'releas':351C,368C,415C,434C 'request':196C,463C 'reset':302C 'safe':338C 'shrt':144C 'silent':264C,484C 'sinc':147C 'singl':166C 'size':120C,198C,210C,253C,256C,347C,446C,454C,465C,498C,506C,512C,530C,542C 'slot':192C 'space':231C,475C 'stay':298C 'str32':242C,485C 'stream':267C 'string':386C 'summari':105C 'swallow':292C,563C 'tag':412C 'take':237C 'threshold':260C 'tri':177C,235C 'underflow':294C,554C 'underflowerror':331C 'unfix':364C 'unpack':142C,268C,301C 'use':284C 'v1.8.6':413C 'verifi':348C 'via':251C 'vm':200C,205C,467C,514C,532C 'wire':279C 'written':127C 'xc6':517C 'xdb':486C 'xdd':439C 'xdf':535C 'xmx512m':437C 'zero':281C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:54:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-73v3-wf97-vpgj","url":"https://github.com/advisories/GHSA-73v3-wf97-vpgj","severity":"high","published_at":"2026-11-12T22:54:59+00:00","modified_at":"2026-11-12T22:55:00+00:00","first_seen_at":"2026-11-12T22:57:32+00:00","fetched_at":"2026-11-12T22:59:39+00:00","note":null}],"documents":[{"id":140062,"url":"https://api.github.com/repos/msgpack/msgpack-ruby/security-advisories/GHSA-73v3-wf97-vpgj","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":140063,"url":"https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-73v3-wf97-vpgj","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":140064,"url":"https://github.com/msgpack/msgpack-ruby/commit/ca0efc1256c687b428c46dd68ce000ff515d53f2","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":140065,"url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.6","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":140066,"url":"https://github.com/msgpack/msgpack-ruby/releases/tag/v1.8.7","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}