CVE-2026-90472: msgpack-java through 0.9.12 Stack Overflow via Nested Arrays
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates network reachability, low attack complexity, no privileges required, and no user interaction required.
Which security properties are affected?
The reported impact is limited availability impact. The CVSS vector indicates no confidentiality or integrity impact and low availability impact.
What component and usage path should be reviewed?
Review uses of msgpack-java through 0.9.12 that call MessageUnpacker.unpackValue() on externally supplied MessagePack data. Deeply nested arrays or maps can cause a StackOverflowError in the thread performing deserialization.