Threats tagged 'ghsa-73v3-wf97-vpgj'

The JRuby implementation of the msgpack Ruby gem (java platform) has a vulnerability where it allocates memory based on container element counts declared in message headers without any upper limit. This can cause the JVM to attempt very large memory allocations, leading to OutOfMemoryError exceptions or significant silent memory retention. The flaw affects msgpack versions prior to 1.8.7 and is unfixed in version 1.8.6. The vulnerability allows a crafted 5-byte message to trigger multi-gigabyte memory allocations, potentially causing denial of service due to memory exhaustion.