Msgpack Ruby
Approved changes feed: RSS · Atom
cpe:2.3:a:msgpack:msgpack-ruby:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Msgpack (98df2d88-8a0c-5639-acc3-a3bfd250039f) |
|---|---|
| Product | Msgpack Ruby (523b8fc8-4319-5025-8a00-d53e8de4c7f8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-54522 |
vulnerable | 2026-09-16 04:33:28.638203 |
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.
Published: 2026-07-30T16:33:06.080Z
Updated: 2026-07-30T17:39:15.020Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.