CVE-2026-54522: MessagePack Buffer Use-After-Free Vulnerability Leading to Cross-Buffer Disclosure
Summary
CVE-2026-54522: MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure. Affects msgpack versions < 1.8.2. Fixed in 1.8.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MessagePack is a binary serialization format that allows for efficient data interchange between different programming languages. The RubyGems package 'msgpack' provides a Ruby implementation of MessagePack, enabling developers to serialize and deserialize data structures easily. However, a vulnerability has been identified in the MessagePack::Buffer class, which can lead to serious memory safety issues, specifically a use-after-free condition that can expose sensitive data across different buffers.
Vulnerability Detail
The vulnerability arises from the MessagePack::Buffer#clear method, which improperly manages memory by not resetting the buffer's read memory cursor after clearing its contents. When the buffer is cleared, it returns its memory page to a shared pool without resetting pointers that reference this memory. This oversight allows subsequent writes to access freed memory, potentially disclosing data from another buffer that has reallocated the same memory page. This leads to a cross-buffer information disclosure and write corruption, posing a risk of leaking sensitive data between different requests or tenants within the same process.
How To Fix
Latest published version: 1.8.5 as of 23 Oct 2026
gem install msgpack -v 1.8.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.8.2
This is the first release that contains the fix.
gem install msgpack -v 1.8.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the MessagePack::Buffer#clear method in scenarios where you plan to reuse the buffer immediately after clearing it. Instead, consider creating a new buffer instance for subsequent writes to prevent potential memory disclosure issues.
Conclusion
The CVE-2026-54522 vulnerability in the MessagePack::Buffer class poses a risk of memory safety issues, including cross-buffer information disclosure and data corruption. It is crucial for developers using the 'msgpack' package to update to version 1.8.2 or later to mitigate these risks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for msgpack →
FAQ
A use-after-free vulnerability occurs when a program continues to use a memory location after it has been freed. This can lead to unpredictable behavior, including data corruption and security issues.
You can use Vulert's playground to check if your application is affected by this vulnerability. Simply upload your manifest file like package-lock.json to receive real-time alerts for open-source vulnerabilities.
The vulnerability can lead to cross-buffer information disclosure, allowing sensitive data from one buffer to be read by another buffer, which can compromise data integrity and confidentiality.
Yes, the vulnerability can lead to write corruption, where data written to one buffer may overwrite data in another buffer, potentially causing application errors or data loss.
The CVSS score for this vulnerability is 2.1, indicating a low severity level, but it still requires attention to ensure application security.
References
Related vulnerabilities
Recent vulnerabilities recorded for msgpack.
