The vulnerability in msgpack-java (up to version 0.9.12) involves uncontrolled recursion in the MessageUnpacker.unpackValue() method. This method deserializes arrays and maps recursively but lacks limits on nesting depth. An attacker can exploit this by sending a payload with deeply nested arrays, causing the deserializing thread's stack to overflow and trigger a StackOverflowError. This leads to per-request deserialization failures, potentially disrupting application functionality.

Exploitation causes a stack overflow error during deserialization, leading to failures in processing requests that use msgpack-java for deserialization. This results in denial of service for affected requests but does not indicate code execution or data corruption based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider limiting the depth of nested data structures before deserialization or applying input validation to reject excessively nested payloads.