CVE-2026-90472 Details
Description
msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.
A stack overflow vulnerability has been identified in msgpack-java versions through 0.9.12. The issue resides in the MessageUnpacker class, specifically within the unpackValue() method. This vulnerability allows for unbounded recursion when deserializing arrays and maps, as there are no limits on nesting depth. Attackers can exploit this by sending payloads with deeply nested arrays, leading to a StackOverflowError. While this causes per-request deserialization failures, the error is recoverable, and no data is altered or lost.
Users can upgrade to msgpack-java version 0.9.13 or later, where this vulnerability has been addressed. Alternatively, the vulnerability can be mitigated by adding a maxNestingDepth parameter to the UnpackerConfig, which limits the recursion depth during deserialization.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 12, 2026CISA-ADP
Assessed Sep 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/msgpack/msgpack-java/issues/1015 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/msgpack/msgpack-java | [email protected] | Vendor |
| https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664 | [email protected] | Source CodeVendor |
| https://github.com/msgpack/msgpack-java/issues/1015 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| msgpack-java | <= 0.9.12 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 14, 2026 | CVE Modified | CISA-ADP |
| Sep 12, 2026 | New CVE Received | [email protected] |