MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.

An update of the rubygem package has been released.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2,
    MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after
    _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write
    and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue
    is fixed in version 1.8.2. (CVE-2026-54522)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2,     MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after
    _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write     and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue     is fixed in version 1.8.2. (CVE-2026-54522)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333263	Photon OS 5.0: Rubygem PHSA-2026-5.0-92-0942	Nessus	PhotonOS Local Security Checks	Local	low
445493	SCA: security update for msgpack (GHSA-4mrv-5p47-p938)	Tenable Cloud Security	SCA Checks	Local	low
445493	SCA: security update for msgpack (GHSA-4mrv-5p47-p938)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
331307	Linux Distros Unpatched Vulnerability : CVE-2026-54522	Nessus	Misc.	Local	low

Detections

Analytics

CVE-2026-54522

low

Tenable Plugins

low

low

low

low