Low, CVSS 2.1RubyGemsAmendedPublished
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
CVE-2026-54522 · GHSA-4mrv-5p47-p938
- Affected
- RubyGems msgpack <= 1.8.1
- Fixed in
- 1.8.2· Vendor fix available
- Issue
- MessagePack::Buffer#clear shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (rmemlast, rmemend, rmemowner). The next write sees "unused rmem space" left over from the freed page and hands back a slice of memory that has already been returned to the pool. A second MessagePack::Buffer then re-acquires that same page, so reading the cleared-and-rewritten buffer discloses the second buffer's bytes — a same-process use-after-free with cross-buffer information disclosure (and the symmetric write-corruption). Details - msgpackbufferclear() → msgpackbuffershiftchunk() (ext/msgpack/buffer.c:151, :128) destroys chunks (msgpackbufferchunkdestroy, :58, returns the page via msgpackrmemfree) but resets only tailbufferend/readbuffer, leaving rmemlast/rmemend/rmemowner pointing into the freed page. - Next Buffer#write → msgpackbufferchunkmalloc() reuse branch (:363) returns b-rmemlast, a pointer into the already-freed page.…
Recommended action: Upgrade to 1.8.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.