CVE-2026-54522
Medium
Description
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.
SeverityMedium
CVSS5.4
Exploit probability—
ProductMsgpack Messagepack
PublishedJul 30, 2026
First seenJul 30, 2026
Weakness typeCWE-416Use after free
How to fix
Update
- msgpack messagepack1.8.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| msgpack messagepack | v < 1.8.2 | 1.8.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.