THREAT OPS › Threat News › [GHSA] GHSA-4mrv-5p47-p938 (low) — MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
[GHSA] GHSA-4mrv-5p47-p938 (low) — MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
GHSA-4mrv-5p47-p938 Severity: low CVE: CVE-2026-54522
MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
### Summary `MessagePack::Buffer#clear` shifts out every chunk and returns its 4 KiB rmem page to the shared pool, but does not reset the buffer's rmem cursor (`rmem_last`, `rmem_end`, `rmem_owner`). The next write sees "unused rmem space" left over from the freed p
Indicators of compromise
- abcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdabcdsha256
- CVE-2026-54522cve
- http://depthfirst.comurl
Original source: https://github.com/advisories/GHSA-4mrv-5p47-p938