CVE-2026-90472
msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
- State
- Published
- Severity
- 6.9 Medium
- Published
- Sep 12, 2026
- Updated
- Sep 24, 2026
- Reserved
- Sep 12, 2026
Description
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | VulnCheck |
Weaknesses
- CWE-674 Uncontrolled Recursion
Affected Products
| Product | Versions |
|---|---|
msgpack-javamsgpack |
|
References
- GitHub Issue #1015issue-tracking
- MessageUnpacker.unpackValue() ARRAY and MAP recursion at v0.9.12technical-description
- https://github.com/msgpack/msgpack-javaproduct
- VulnCheck Advisory: msgpack-java through 0.9.12 Stack Overflow via Nested Arraysthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.