Vulnerability · Published Sep 12, 2026 · Assigned by VulnCheck

CVE-2026-90473msgpack-java through 0.9.12 Integer Overflow via MAP32

Medium 5.3

In plain English

A medium-severity integer overflow in msgpack-java from msgpack. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 64.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	msgpack-java	no fix listed	DEBIAN-CVE-2026-90473
Debian:13	msgpack-java	no fix listed	DEBIAN-CVE-2026-90473
Debian:14	msgpack-java	no fix listed	DEBIAN-CVE-2026-90473
Ubuntu:22.04:LTS	msgpack-java	no fix listed	UBUNTU-CVE-2026-90473
Ubuntu:24.04:LTS	msgpack-java	no fix listed	UBUNTU-CVE-2026-90473
Ubuntu:26.04:LTS	msgpack-java	no fix listed	UBUNTU-CVE-2026-90473
Ubuntu:26.10	msgpack-java	no fix listed	UBUNTU-CVE-2026-90473

Affected products (as reported)

Vendor	Product	Versions
msgpack	msgpack-java	0 – through 0.9.12

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

GitHub Issue #1014 issue-tracking
MessageUnpacker.skipValue() ARRAY32/MAP32 length handling at v0.9.12 technical-description
https://github.com/msgpack/msgpack-java product
VulnCheck Advisory: msgpack-java through 0.9.12 Integer Overflow via MAP32 third-party-advisory