CVE-2026-126366 | msgpack MessagePack for Ruby up to 1.8.6 Unpacker MessagePack.unpack array32/str32/bin32 allocation of resources

November 13, 2026 Yanac

A vulnerability, which was classified as problematic, was found in msgpack MessagePack for Ruby up to 1.8.6. Affected is the function MessagePack.unpack of the component Unpacker. The manipulation of the argument array32/str32/bin32 results in allocation of resources.

This vulnerability was named CVE-2026-126366. The attack may be performed from remote. There is no available exploit.

You should upgrade the affected component.VulDB Recent EntriesRead More