AIKIDO-2026-475677

TL;DR

The MessagePack Ruby unpacker reads 32-bit map and container length fields when deserializing binary input. Before the fix, length arithmetic such as count*2 could wrap on large declared sizes, so malformed or truncated payloads were handled incorrectly instead of failing safely. An attacker supplying crafted MessagePack data to MessagePack.unpack or an Unpacker could trigger incorrect parse boundaries. The fix uses size_t for native length math and rejects oversized 32-bit sizes on JRuby so underflow and truncation raise errors.