Threats affecting pkg:maven/org.msgpack/msgpack-core

msgpack-java versions up to 0.9.12 contain an integer overflow vulnerability in the MessageUnpacker.skipValue() method. This occurs when processing MAP32 containers with very large element counts, specifically at or above 0x40000000. The overflow causes the parser cursor to desynchronize, potentially resulting in attacker-controlled data being returned instead of expected fields. The vulnerability has a medium severity with a CVSS score of 6.9.

CVE-2026-90472 is a stack overflow vulnerability in msgpack-java versions up to 0.9.12. It occurs in the MessageUnpacker.unpackValue() method, which recursively deserializes arrays and maps without limiting nesting depth. Crafted payloads with deeply nested arrays can cause a StackOverflowError, leading to deserialization failures during request processing.

CVE-2026-21452 is a high-severity denial-of-service vulnerability in msgpack-java versions prior to 0.9.11. It arises from uncontrolled resource consumption during deserialization of maliciously crafted . msgpack files containing EXT32 objects with attacker-controlled payload lengths. The vulnerability allows remote attackers to cause JVM heap exhaustion and service crashes without requiring authentication or user interaction. This can disrupt applications that deserialize untrusted . msgpack files, such as model registries, inference services, and CI/CD pipelines. The exploit involves a small but valid . msgpack file that bypasses basic validation and triggers unbounded memory allocation.