CVE-2026-90473: msgpack-java through 0.9.12 Integer Overflow via MAP32
msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.
Affected Software
Event History
Frequently Asked Questions
What input is required to exploit this issue?
An attacker must be able to supply MessagePack data that is processed by MessageUnpacker.skipValue(). The payload must contain a MAP32 container with an element count of at least 0x40000000.
What is the security impact of a successful exploit?
The MAP32 element count can overflow when it is doubled, desynchronizing the parser cursor. This can cause attacker-controlled data to be returned in place of fields that follow the skipped value, affecting data integrity.
How can I determine whether my application is affected?
Applications using msgpack-java through version 0.9.12 are affected if they process untrusted MessagePack input and invoke MessageUnpacker.skipValue() on data that may contain MAP32 containers. Review parsing paths that skip values before reading later fields.