CVE-2026-126366

{
  "etk_id": "ETK-2026-4328",
  "cve_id": "CVE-2026-126366",
  "display_id": "CVE-2026-126366",
  "ghsa_id": "GHSA-73v3-wf97-vpgj",
  "euvd_id": "EUVD-2026-124750",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded allocation in msgpack-ruby's JRuby decoder",
  "summary": "The Java-platform msgpack-ruby gem used with JRuby is affected before version 1.8.7. An attacker who can supply MessagePack data for decoding can cause excessive JVM heap allocation and disrupt the hosting process. Exploitation requires an application to decode untrusted MessagePack input through the affected JRuby implementation.",
  "mitigation": "Upgrade msgpack-ruby to version 1.8.7 or later on JRuby. Until upgraded, restrict MessagePack decoding to trusted inputs and enforce input-size limits before parsing.",
  "vendor": "msgpack",
  "product": "msgpack-ruby",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.8.6"
      ],
      "ecosystem": "rubygems",
      "fixed_versions": [
        "1.8.7"
      ],
      "package_name": "msgpack",
      "purl": "pkg:gem/msgpack"
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 14.464938233333333,
  "t0_at": "2026-11-12T22:41:38.409000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-12T23:16:05.410092+00:00",
      "days": 0.02392362375,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T22:41:38.409000+00:00",
      "url": null
    },
    "public_poc": {
      "at": "2026-11-12T22:54:59+00:00",
      "days": 0.009266099537037036,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T22:41:38.409000+00:00",
      "url": "https://github.com/advisories/GHSA-73v3-wf97-vpgj"
    },
    "trigger_signal": {
      "at": "2026-11-12T22:41:38.409000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T22:41:38.409000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-126366"
    }
  }
}