Stack Overflow Vulnerability in msgpack-java by Msgpack

CVE-2026-90472

What is CVE-2026-90472?

The msgpack-java library, up to version 0.9.12, is susceptible to a stack overflow vulnerability occurring within the MessageUnpacker.unpackValue() method. This vulnerability arises when the library deserializes arrays and maps recursively, lacking limits on nesting depth. Malicious actors can exploit this flaw by sending specially crafted payloads with deeply nested arrays, which can lead to exhausting the stack of the deserializing thread. As a result, this may trigger StackOverflowError, manifesting as deserialization failures for requests, potentially disrupting functionality.

References