{"action":"Upgrade msgpack to 1.8.2 or later.","affected":[{"fixed":"1.8.2","introduced":"0"}],"component":"msgpack","cve_ids":["CVE-2026-54522"],"ecosystem":"RubyGems","epss":0.00227,"exploited":false,"fixed_versions":["1.8.2"],"ghsa_id":"GHSA-4mrv-5p47-p938","id":"tcs_01M5KEGNBX2F30V67N7F3F6SWB","modified_at":"2026-09-10T03:51:10.426858154Z","published_at":"2026-07-30T16:33:12Z","references":["https://osv.dev/vulnerability/GHSA-4mrv-5p47-p938","https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938","https://github.com/msgpack/msgpack-ruby/commit/5627d71606b565641d2dd501b82aae862f4abe90","https://github.com/msgpack/msgpack-ruby","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/msgpack/CVE-2026-54522.yml","https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-54522"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-4mrv-5p47-p938","url":"https://osv.dev/vulnerability/GHSA-4mrv-5p47-p938"}],"summary":"MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure"}