Denial of Service Vulnerability in MessagePack for Java by MsgPack

CVE-2026-21452

What is CVE-2026-21452?

MessagePack for Java contains a vulnerability that allows for remote denial-of-service attacks during the deserialization of .msgpack files. When the library processes EXT32 objects from these files, it trusts the payload length declared in the header. If crafted by an attacker, this can lead to unbounded heap allocation, exhausting JVM memory and resulting in application failure. The exploit does not require malformed data, user interaction, or elevated permissions, making it especially dangerous in environments such as CI/CD pipelines and cloud services that utilize model files. Users are encouraged to upgrade to version 0.9.11 to mitigate this risk.

References