Medium severity5.3NVD Advisory· Published Sep 12, 2026

CVE-2026-90472

Description

msgpack-java through 0.9.12 contains a stack overflow vulnerability in MessageUnpacker.unpackValue() that recursively deserializes arrays and maps without nesting depth limits. Attackers can craft payloads with deeply nested arrays to exhaust the deserializing thread's stack and trigger StackOverflowError, causing per-request deserialization failures.

Affected products

Msgpack/Msgpack Javareferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=0.9.12

Patches

Vulnerability mechanics

References

github.com/msgpack/msgpack-java/blob/v0.9.12/msgpack-core/src/main/java/org/msgpack/core/MessageUnpacker.javanvd
github.com/msgpack/msgpack-java/issues/1015nvd
www.vulncheck.com/advisories/msgpack-java-through-0.9.12-stack-overflow-via-nested-arraysnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000