CVE-2026-90472

MEDIUM 5.3

msgpack-java through 0.9.12 Stack Overflow via Nested Arrays

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

CWE	CWE-674
Vendor	msgpack
Product	msgpack-java
Published	Sep 12, 2026
Last Updated	Sep 14, 2026

Stay Ahead of the Next One

Get instant alerts for msgpack msgpack-java

Be the first to know when new medium vulnerabilities affecting msgpack msgpack-java are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Affected Versions

msgpack / msgpack-java

0 ≤ 0.9.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/msgpack/msgpack-java/issues/1015 github.com: https://github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.java#L646-L664 github.com: https://github.com/msgpack/msgpack-java vulncheck.com: https://www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arrays

Credits

🔍 Wayde Shi (PayPal Cyber Security Team)