MEDIUM

CVE-2026-90472

2026-09-12 CVSS v3.1

CVSS

5.3

Description

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

Weakness (CWE)

CWE-674

EPSS Score

0.33%

Probability of exploitation in next 30 days

26.7th percentile

References

https://github.com/msgpack/msgpack-java https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664 https://github.com/msgpack/msgpack-java/issues/1015 https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE