Integer Overflow Vulnerability in msgpack-java Product

CVE-2026-90473

What is CVE-2026-90473?

The msgpack-java library, up to version 0.9.12, contains an integer overflow vulnerability that affects the MessageUnpacker.skipValue() method. This issue arises when processing MAP32 containers with large element counts. Attackers can exploit this vulnerability by supplying a MAP32 element count of 0x40000000 or higher, which, when doubled, leads to a wrap-around effect. Consequently, the parser's cursor becomes desynchronized, allowing attacker-controlled data to be returned, potentially compromising the integrity of the data processed by the application.

References